Chanjet CRM vulnerabilities

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization through UNION-based injection to extract sensitive data from the database.

A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.

A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.