CVE-2026-84111: Chanjet CRM jxf_dump_table.php sql injection
A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxfdumptable.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable over the network and requires no privileges or user interaction. Exploitation involves manipulating the gblOrgID argument supplied to jxf_dump_table.php.
Which deployments should be treated as potentially affected?
Chanjet CRM versions up to 20260707 are identified as affected. The available information does not state whether the vulnerable file or argument is exposed in a default configuration.
Is public exploit material available?
Yes. An exploit has been published and may be used, increasing the likelihood of exploitation attempts.
Is a vendor fix or response available?
No vendor response is reported. If patching is not immediately possible, the provided information does not identify a specific mitigation; prioritize restricting remote access to the affected application endpoint where operationally feasible.