CVE-2021-48008highobserved exploitationCWE-89

CVE-2021-48008: high-severity vulnerability in Chanjet Information Technology Co., Ltd. CRM

Chanjet CRM SQL Injection via get_usedspace.php

Published · Updated

Follow this CVE+ Monitor CRM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 8.7epss 0.6%
from disclosure to weapon
Published on NVDSep 18
VulnCheckOct 18
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Chanjet Information Technology Co., Ltd. · CRM