CVE-2021-48008
Chanjet CRM SQL Injection via get_usedspace.php
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
| CWE | CWE-89 |
| Vendor | chanjet information technology co., ltd. |
| Product | crm |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for chanjet information technology co., ltd. crm
Be the first to know when new high vulnerabilities affecting chanjet information technology co., ltd. crm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Chanjet Information Technology Co., Ltd. / CRM
*
References
cnvd.org.cn: https://www.cnvd.org.cn/flaw/show/CNVD-2021-12845 raw.githubusercontent.com: https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/vulnerabilities/chanjet-tplus/chanjet-crm-sqli.yaml chanjet.com: https://www.chanjet.com/ vulncheck.com: https://www.vulncheck.com/advisories/chanjet-crm-sql-injection-via-get-usedspace-php
Credits
🔍 The Shadowserver Foundation