Which versions of PHP are affected by CVE-2025-14189?

Chanjet CRM installations are vulnerable to remote SQL injection attacks through an exposed database utility file, potentially allowing attackers to access, modify, or exfiltrate sensitive customer…

How to fix or mitigate CVE-2025-14189?

Within 24 hours: Identify all Chanjet CRM instances and verify installed versions against 20251121; isolate affected systems from production networks if possible and enable comprehensive logging on database access. Within 7 days: Implement WAF rules blocking access to /tools/jxf_dump_table_demo.php, restrict access to this endpoint by IP whitelist, and apply database query parameterization patches if feasible through internal development. Within 30 days: Contact Chanjet for security updates, evaluate migration to alternative CRM solutions, and conduct forensic analysis to determine if the vulnerability was exploited.

PHP CVE-2025-14189

Q: What is the CVSS score of CVE-2025-14189?

CVE-2025-14189 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201600 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-07 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 17:50 euvd

EUVD-2025-201600

Analysis Generated

Mar 15, 2026 - 17:50 vuln.today

CVE Published

Dec 07, 2025 - 12:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in Chanjet CRM up to 20251121. Affected is an unknown function of the file /tools/jxf_dump_table_demo.php. The manipulation of the argument gblOrgID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Chanjet CRM up to version 20251121 allows remote attackers to manipulate database queries via the gblOrgID parameter in /tools/jxf_dump_table_demo.php. Public exploit code is available, enabling practical attacks despite a low EPSS exploitation probability of 0.04%. The vendor has not responded to disclosure, leaving no official patch.