VULNERABILITY INTELLIGENCE
CVE-2021-48008
CVSS score7.5 HIGH
EPSS probability0.57%
CISA KEVNot currently listed
Published2026-09-18
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Weakness classification
- disclosure@vulncheck.com: CWE-89