Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2021-48008Chanjet CRM SQL Injection via get_usedspace.php

High 7.5

In plain English

A high-severity SQL injection in CRM from Chanjet Information Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Affected products (as reported)

Vendor	Product	Versions
Chanjet Information Technology Co., Ltd.	CRM	*

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CNVD-2021-12845 third-party-advisory
Nuclei Template technical-description
Vendor Homepage product
https://www.vulncheck.com/advisories/chanjet-crm-sql-injection-via-get-usedspace-php third-party-advisory