Description

A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-01T15:17:41.200Z",
  "pubdate": "2026-09-01T15:17:41.200Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in Chanjet CRM up to version 20260707, specifically residing within the jxf_dump_table.php file. The flaw is triggered by improper sanitization of the gblOrgID argument during processing.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database. Successful exploitation poses a severe risk to the confidentiality, integrity, and availability of the application's data. An attacker can leverage this flaw to extract sensitive information, bypass authentication mechanisms, or perform unauthorized administrative actions.\nThe vulnerability is currently exploited in the wild, and public proof-of-concept exploits exist, significantly lowering the barrier for entry for malicious actors. Given that the vendor has not provided a response or a patch to address the disclosure, the risk profile is elevated for organizations relying on affected Chanjet CRM deployments. Immediate defensive measures are required to mitigate potential exposure.",
  "technicalDetails": "The vulnerability is located in the processing logic of jxf_dump_table.php within the Chanjet CRM application. The root cause is the failure to properly validate and sanitize the gblOrgID input parameter before it is incorporated into database queries.\nThe attack flow initiates when an attacker submits a crafted HTTP request to the vulnerable endpoint jxf_dump_table.php. The attacker manipulates the gblOrgID argument, injecting malicious SQL syntax designed to alter the query logic. Because the application processes this input without adequate parameterization or escaping, the database engine executes the injected SQL commands as part of the intended statement.\nThe vulnerability facilitates various SQL injection techniques, including Union-based, Error-based, and Blind SQL injection. By injecting tailored payloads, an attacker can bypass existing application-level authentication, exfiltrate the entire contents of the database, or manipulate application data. The scope of impact is limited only by the privileges assigned to the database user account used by the CRM application to connect to the database. If the web application connects with elevated privileges, such as a database administrator or DBO, the attacker may achieve full system compromise, including the ability to read or modify arbitrary data and potentially execute administrative database operations.\nThe vulnerability is accessible remotely via the network, and the lack of stated authentication requirements for this specific endpoint suggests that the attack can be executed by unauthenticated remote users. The exploitation is trivial once the endpoint is reachable, as the public availability of exploits enables automated scanning and exploitation. Post-exploitation impact includes complete loss of database confidentiality, potential loss of integrity if the database user permissions allow for data modification (e.g., UPDATE or DROP statements), and, depending on database configuration, potential remote code execution on the underlying database server via features like xp_cmdshell or file system interaction commands."
}