CVE-2021-48008: Chanjet CRM SQL Injection via get_usedspace.php
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or prior privileges are required. A remote attacker can target the webservice endpoint and manipulate the site_id GET parameter.
What is the likely impact of successful exploitation?
An attacker can execute arbitrary SQL queries using UNION-based injection techniques. This may allow extraction of sensitive data from the underlying database.
Is there evidence that this vulnerability has been exploited?
Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.