CVE-2026-11456: Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxfdumpsystable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Chanjet CRM /tools/jxf_dump_systable.phpfrom your environment.If the script is not required, remove or disable /tools/jxf_dump_systable.php (or rename it to prevent web access) until a secure fix is implemented.
- Configuration
Modify the /tools/jxf_dump_systable.php handler to perform strict validation and sanitization of the gblOrgID parameter and use parameterized/prepared statements for all database access to eliminate SQL injection.
Chanjet CRM (/tools/jxf_dump_systable.php) gblOrgID input handling = validate and sanitize; use parameterized queries - Compensating control
Restrict access to the vulnerable endpoint at the network perimeter or web server (e.g., firewall rules) so that only trusted IP addresses or internal networks can reach /tools/jxf_dump_systable.php.
- Compensating control
Deploy web application firewall (WAF) rules to detect and block SQL injection attempts targeting the gblOrgID parameter and known exploit patterns against /tools/jxf_dump_systable.php.
- Operational
Review web server and application logs for signs of exploitation; if any compromise is suspected, perform incident response actions such as containment, eradication, and rotate credentials and secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11456?
The severity of CVE-2026-11456 is rated as high with a score of 7.3.
How do I fix CVE-2026-11456?
To fix CVE-2026-11456, update Chanjet CRM to the latest version that addresses the SQL injection vulnerability.
What components are affected by CVE-2026-11456?
CVE-2026-11456 affects the HTTP GET Request Handler component in the file /tools/jxf_dump_systable.php.
Can CVE-2026-11456 be exploited remotely?
Yes, CVE-2026-11456 can be exploited remotely due to its nature of SQL injection vulnerability.
What type of vulnerability is CVE-2026-11456 categorized as?
CVE-2026-11456 is categorized as a SQL Injection vulnerability.