CVE-2026-11456: Critical SQL Injection in Chanjet CRM 1.0

Technical summary

The vulnerability is a SQL injection flaw (CWE-89) resulting from improper input validation (CWE-74) in the HTTP GET request handler component. The gblOrgID parameter is passed unsanitized to SQL queries executed by /tools/jxf_dump_systable.php. The attack vector is network-based with low attack complexity, no privilege requirements, no user interaction needed, and impacts the confidentiality, integrity, and availability of the underlying database. The CVSS 3.1 base score of 7.3 reflects the high severity of unauthenticated remote SQL injection.

Business impact

Successful exploitation could allow attackers to exfiltrate sensitive customer data, organization details, or internal CRM records stored in the database. Beyond data theft, attackers may modify or delete critical business information, potentially disrupting CRM operations and customer relationship workflows. The public availability of exploit code and vendor non-responsiveness elevate the practical risk that this vulnerability will be actively exploited against deployed instances.

Affected systems

Chanjet CRM version 1.0 is confirmed vulnerable. Organizations running this version of Chanjet CRM are at risk. The vendor contact details and any information about whether later versions have remediated this issue are not yet confirmed; verify directly with Chanjet regarding patched versions and update availability.

Exploitability

The vulnerability is highly exploitable: it requires no authentication, no special privileges, no user interaction, and can be triggered remotely via a simple HTTP GET request. Exploit code is publicly available, reducing the technical barrier to weaponization. The low attack complexity means attackers do not need to perform reconnaissance or bypass any significant obstacles beyond basic HTTP request manipulation.

Remediation

Immediate action is required. Organizations should contact Chanjet directly to determine if a patched version is available and obtain guidance on upgrading from version 1.0. Interim mitigation may include restricting network access to the /tools/jxf_dump_systable.php endpoint via firewall rules or web application firewall (WAF) policies, and implementing input validation or parameterized queries at the application level if source code access is available. A complete security audit of other endpoints and parameters in Chanjet CRM should be performed.

Patch guidance

The vendor was contacted early but has not responded publicly with a patch or advisory as of the vulnerability publication date (June 7, 2026). Organizations should contact Chanjet support directly to inquire about available security updates and timeline for remediation. If patches become available, they should be tested in a staging environment before production deployment. Verify patch applicability for your specific Chanjet CRM deployment configuration.

Detection guidance

Monitor HTTP GET requests to /tools/jxf_dump_systable.php for suspicious gblOrgID parameter values, including SQL metacharacters (single quotes, double dashes, UNION keywords, etc.). Web application firewalls (WAF) should be configured with SQL injection detection rules. Review web server and application logs for any requests to this endpoint, paying special attention to unusual parameter encoding or character sequences. Database query logs may show evidence of injected SQL statements. Baseline traffic patterns and implement alerts for deviation.

Why prioritize this

This vulnerability merits high priority due to the combination of unauthenticated network-accessible SQL injection, public exploit availability, no required user interaction, and vendor non-responsiveness. SQL injection on a CRM system threatens customer data confidentiality, business continuity, and regulatory compliance. The low attack complexity and high exploitability make this an attractive target for opportunistic and targeted attacks.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the severity of unauthenticated, remotely exploitable SQL injection with impacts to confidentiality, integrity, and availability. The score does not account for the aggravating factor of publicly available exploit code or vendor non-response, both of which increase practical risk beyond the base score. Organizations should treat this as a critical operational security issue.

Frequently asked questions