# CVE-2026-11456: Chanjet CRM SQL injection in jxf_dump_systable.php

Source: https://junglewise.ai/threats/cve-2026-11456-chanjet-crm-sql-injection-in-jxf-dump-systable-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-11456 · Severity: high · CVSS 7.3 · Published 2026-06-07

Chanjet CRM, a software suite used for managing customer relationships and business data, contains a security flaw that allows unauthorized access to its database. An attacker can exploit this to steal sensitive customer information, modify business records, or disrupt operations. This vulnerability can be triggered remotely without needing a username or password.

## Quick answers

**Is CVE-2026-11456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11456 being exploited in the wild.

**How severe is CVE-2026-11456?** High severity, with a CVSS score of 7.3, published 7 June 2026.

**Which products and versions are affected?** Chanjet CRM 1.0.

**Is there a fix for CVE-2026-11456?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11456 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11456?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Chanjet CRM 1.0 within the /tools/jxf_dump_systable.php file. The root cause is the improper neutralization of the 'gblOrgID' parameter, which is directly concatenated into SQL queries without validation or parameterization. An unauthenticated remote attacker can exploit this via a specially crafted HTTP GET request to execute arbitrary SQL commands. A public exploit (PoC) utilizing time-based blind SQL injection is available. The vendor has reportedly not responded to disclosure attempts, and no official patch is currently confirmed.

## Affected products

- Chanjet CRM 1.0

## Timeline

- 2026-05-13: disclosed: Initial researcher disclosure via GitHub Gist
- 2026-06-07: advisory: NVD/VulDB publication date

## References

- [https://gist.github.com/jikdarren/67ba9fdd2a8b619fc9a370102c317971](https://gist.github.com/jikdarren/67ba9fdd2a8b619fc9a370102c317971)
- [https://vuldb.com/cve/CVE-2026-11456](https://vuldb.com/cve/CVE-2026-11456)
- [https://vuldb.com/submit/828375](https://vuldb.com/submit/828375)
- [https://vuldb.com/vuln/369075](https://vuldb.com/vuln/369075)
- [https://vuldb.com/vuln/369075/cti](https://vuldb.com/vuln/369075/cti)