CVE-2021-48008 | BDVDB-2026-376559 Detail

Description#

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-18Record published in the CVE List.
2. Version 22026-09-21Most recent update recorded in the CVE List.