This vulnerability in Chanjet CRM 1.0 involves improper sanitization of the gblOrgID parameter in the HTTP GET Request Handler located in /tools/jxf_dump_systable.php. An attacker can remotely supply crafted input to this parameter to execute SQL injection attacks against the backend database. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and the vulnerability remains unmitigated as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is rated medium due to limited scope of the vulnerability and partial impact on confidentiality, integrity, and availability. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations using Chanjet CRM 1.0 should consider implementing compensating controls such as input validation or web application firewalls to detect and block malicious SQL injection attempts targeting the gblOrgID parameter. Monitoring for unusual database activity related to this endpoint is also advisable until an official fix is available.