Unauthenticated SQL Injection in Chanjet CRM by Chanjet
CVE-2021-48008

8.7HIGH

Key Information:

Vendor

Chanjet Information Technology Co., Ltd.

Status
Crm
Vendor
CVE Published:
18 September 2026

What is CVE-2021-48008?

Chanjet CRM is susceptible to an unauthenticated SQL injection vulnerability. This flaw allows remote attackers to execute arbitrary SQL queries by manipulating the 'site_id' parameter in the webservice endpoint. The vulnerability arises due to inadequate input sanitization and parameterization, enabling attackers to utilize UNION-based injection techniques to extract sensitive information from the database. Evidence of exploitation was first reported by the Shadowserver Foundation on October 18, 2023. It is critical for users to apply security patches released by Chanjet and to assess their exposure to potential data breaches.

Affected Version(s)

CRM *

References

https://www.cnvd.org.cn/flaw/show/CNVD-2021-12845
third-party-advisory
https://raw.githubusercontent.com/projectdiscovery/nuclei...
technical-description
https://www.chanjet.com/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.