CVE-2021-48008 in Chanjet
Summary
by MITRE • 09/18/2026
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Chanjet CRM represents a critical security flaw rooted in insufficient input validation and sanitization mechanisms within its web service architecture. Specifically, the site_id GET parameter located at the webservice endpoint fails to properly filter or escape user-supplied data before it is incorporated into SQL queries executed by the backend database engine. This lack of proper parameterization allows remote attackers to inject malicious SQL code directly into the application logic. The absence of robust input validation creates a direct pathway for exploitation, enabling adversaries to manipulate the structure of legitimate database commands rather than merely altering their intended parameters.
Exploitation of this vulnerability relies on UNION-based injection techniques, which allow an attacker to combine results from multiple SELECT statements into a single result set. By carefully crafting payloads that append SQL syntax to the site_id parameter, attackers can bypass existing authentication controls and execute arbitrary queries against the underlying database. This capability is particularly dangerous because it facilitates the extraction of sensitive data stored within the CRM system, including potentially confidential customer information, internal business records, or administrative credentials. The ability to perform UNION-based injections means that even if error messages are suppressed, an attacker can still infer database structure and retrieve specific columns by aligning their injected query with the original result set's column count.
The operational impact of this vulnerability is severe, as it compromises the confidentiality and integrity of the entire Chanjet CRM deployment. Since authentication is not required to trigger the injection, any internet-facing instance of the software is immediately vulnerable without needing valid user credentials. This unauthenticated access vector significantly lowers the barrier for entry, allowing automated scanning tools and opportunistic attackers to exploit the flaw at scale. The evidence observed by the Shadowserver Foundation on October 18, 2023, indicates that this vulnerability has been actively exploited in the wild, suggesting that organizations running affected versions are likely already under attack or have suffered data exfiltration.
From a classification perspective, this issue aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under MITRE ATT&CK technique T1059.004 SQL Injection. The unauthenticated nature of the exploit further emphasizes its severity, as it does not rely on privilege escalation or credential theft to achieve initial access. To mitigate this risk, immediate remediation should involve applying vendor-provided patches that enforce strict input validation and utilize parameterized queries for all database interactions involving user-supplied data. Additionally, implementing Web Application Firewalls with specific rulesets designed to detect SQL injection patterns can provide a temporary layer of defense while patching is deployed. Regular security assessments and code reviews focusing on input handling are essential to prevent similar vulnerabilities in the future.