CVE-2021-48008 — Chanjet CRM SQL Injection via get_usedspace.php
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in th…
Published: 2026-09-18 · CVSS: 8.7 · CVSS 4.0
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7