CVE-2026-11456
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.
Risk Assessment
An unauthenticated attacker can remotely manipulate the CRM database, potentially leading to leakage or modification of sensitive customer data.
Recommendation
Immediately isolate the system from external networks and contact the vendor for a patch. In the meantime, apply WAF rules to block suspicious requests.
Other vulnerabilities in Chanjet CRM
See all- CVE-2021-48008High
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization through UNION-based injection to extract sensitive data from the database.
- CVE-2026-84111High
A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS