Executive brief
Chanjet CRM, a software suite used for managing customer relationships and business data, contains a security flaw that allows unauthorized access to its database. An attacker can exploit this to steal sensitive customer information, modify business records, or disrupt operations. This vulnerability can be triggered remotely without needing a username or password.
Technical details
A SQL injection vulnerability exists in Chanjet CRM 1.0 within the /tools/jxf_dump_systable.php file. The root cause is the improper neutralization of the 'gblOrgID' parameter, which is directly concatenated into SQL queries without validation or parameterization. An unauthenticated remote attacker can exploit this via a specially crafted HTTP GET request to execute arbitrary SQL commands. A public exploit (PoC) utilizing time-based blind SQL injection is available. The vendor has reportedly not responded to disclosure attempts, and no official patch is currently confirmed.
Affected products
- Chanjet CRM 1.0
Timeline
- 2026-05-13: disclosed: Initial researcher disclosure via GitHub Gist
- 2026-06-07: advisory: NVD/VulDB publication date