Which versions of PHP are affected by CVE-2025-6132?

A critical SQL injection vulnerability in Chanjet CRM 1.0 allows remote attackers to compromise database integrity and extract sensitive organizational data without authentication.

Is there a public PoC exploit available for CVE-2025-6132?

Yes, a public proof-of-concept exploit is available for CVE-2025-6132. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6132?

Within 24 hours: Identify all systems running Chanjet CRM 1.0 and assess data sensitivity; isolate affected systems from production networks if feasible. Within 7 days: Implement WAF rules to block malicious requests to /sysconfig/departmentsetting.php; disable the departmentsetting feature if not critical to operations; apply request validation filters on the gblOrgID parameter. Within 30 days: Evaluate migration to patched versions or alternative CRM solutions; conduct forensic analysis for signs of exploitation; implement enhanced database monitoring and access controls.

PHP CVE-2025-6132

Q: What is the CVSS score of CVE-2025-6132?

CVE-2025-6132 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18423 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-16 cna@vuldb.com

PHP SQLi Chanjet Crm Chanjet

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18423

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Dec 03, 2025 - 21:13 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig/departmentsetting.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in Chanjet CRM 1.0 affecting the /sysconfig/departmentsetting.php endpoint via the gblOrgID parameter. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential, making it a high-priority remediation target despite the moderate CVSS score.

Technical ContextAI

This vulnerability exploits improper input validation in a PHP-based web application (Chanjet CRM). The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as CWE-89 SQL Injection when specifically targeting SQL contexts). The vulnerable endpoint /sysconfig/departmentsetting.php fails to properly sanitize or parameterize the gblOrgID user input before incorporating it into SQL query construction. This allows attackers to inject malicious SQL syntax that modifies query logic. The attack vector is network-based with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), indicating the vulnerability is accessible from any network position without credentials. The affected product is Chanjet CRM version 1.0, a customer relationship management platform likely used in enterprise environments.

RemediationAI

Immediate actions: (1) Apply vendor security patch if available from Chanjet (contact vendor directly for CVE-2025-6132 patch status, as no specific patch URL is provided in available intelligence); (2) If patching is unavailable, implement input validation and parameterized queries in /sysconfig/departmentsetting.php to sanitize the gblOrgID parameter using prepared statements or parameterized query APIs; (3) Restrict access to /sysconfig/departmentsetting.php via network access controls (firewall, WAF) to trusted administrative IP ranges; (4) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the gblOrgID parameter (e.g., regex detecting SQL keywords, quote characters, or comment syntax); (5) Apply database-level principle of least privilege—ensure the CRM database account used by the application has minimal required permissions, not full administrative rights; (6) Enable database query logging and monitor for anomalous SQL execution patterns; (7) Conduct urgent security audit of other PHP endpoints in Chanjet CRM for similar injection vulnerabilities.