CVE-2026-84111: SQL Injection in Chanjet CRM
Description
A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 6.9medium
Affected software
Chanjet
CRM
cpe:2.3:a:chanjet:crm:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Chanjet CRM up to version 20260707 involves improper sanitization of the gblOrgID argument in the jxf_dump_table.php file, leading to SQL injection. The flaw allows remote attackers to inject malicious SQL commands, potentially compromising the database. The vendor has not provided any response or fix, and exploit code is publicly available. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to unauthorized SQL commands execution on the backend database, potentially exposing or modifying sensitive data. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. Remote exploitation is possible without authentication.
Mitigation Recommendations
No official fix or patch is currently available from the vendor. Users should monitor vendor communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the gblOrgID parameter in jxf_dump_table.php. Restricting access to this script and input validation may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-01T07:10:50.542Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a96e33cacd9273b49d390ce
Added to database: 09/01/2026, 14:37:48 UTC
Last enriched: 09/07/2026, 14:47:14 UTC
Last updated: 10/14/2026, 18:48:24 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.