CVE-2021-48008

7.5 HIGH

Published 2026-09-18 · Updated 2026-09-24

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-89

All references

https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/vulnerabilities/chanjet-tplus/chanjet-crm-sqli.yaml
https://www.chanjet.com/
https://www.cnvd.org.cn/flaw/show/CNVD-2021-12845
https://www.vulncheck.com/advisories/chanjet-crm-sql-injection-via-get-usedspace-php

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2015-20122
HIGHCVE-2019-25776PoC
HIGHCVE-2022-4997
CRITICALCVE-2023-54399
CRITICALCVE-2023-54400PoC
CRITICALCVE-2025-63564
MEDIUMCVE-2026-100312PoC
HIGHCVE-2026-100314PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.