Which versions of Chanjet CRM are affected by CVE-2026-11456?

Chanjet CRM 1.0 contains an unauthenticated SQL injection vulnerability in the /tools/jxf_dump_systable.php endpoint that allows remote attackers to inject arbitrary database queries without…

Is there a public PoC exploit available for CVE-2026-11456?

Yes, a public proof-of-concept exploit is available for CVE-2026-11456. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11456?

24 hours: Inventory all Chanjet CRM 1.0 instances in production and staging; deploy firewall or WAF rules to block access to /tools/jxf_dump_systable.php or filter SQL injection patterns; enable database query audit logging. 7 days: Review database access logs for signs of exploitation; contact Chanjet vendor regarding security remediation timeline and interim guidance; evaluate alternative CRM platforms. 30 days: Implement upgrade to patched Chanjet version (if released by vendor) or complete migration to alternative CRM solution; validate remediation through post-implementation security assessment.

Chanjet CRM CVE-2026-11456

Q: What is the CVSS score of CVE-2026-11456?

CVE-2026-11456 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34986 MEDIUM

SQL Injection (CWE-89)

2026-06-07 VulDB

GHSA-m34f-6c67-jx84

PHP SQLi Crm Chanjet

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 09:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 09:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 08:42 vuln.today

DescriptionCVE.org

A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Chanjet CRM 1.0 allows remote unauthenticated attackers to manipulate the gblOrgID parameter of /tools/jxf_dump_systable.php to inject arbitrary SQL into the backend database. Publicly available exploit code exists (referenced via a public gist), and the vendor did not respond to disclosure attempts, leaving deployments exposed without official remediation. EPSS data was not provided and the issue is not in CISA KEV, but the combination of network-reachable HTTP GET handler, no authentication requirement, and a public POC makes opportunistic exploitation realistic.

Technical ContextAI

Chanjet CRM is a PHP-based customer relationship management application (CPE cpe:2.3:a:chanjet:crm:*). The vulnerable endpoint /tools/jxf_dump_systable.php processes user-supplied input from the gblOrgID HTTP GET parameter and incorporates it into a SQL query without proper sanitization or parameterization. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw, typical of legacy PHP applications that concatenate request parameters directly into queries instead of using prepared statements with bound parameters.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor did not respond to coordinated disclosure. Operators should apply compensating controls: restrict network access to /tools/jxf_dump_systable.php via a reverse proxy or web server ACL so only trusted administrative IPs can reach it (side effect: legitimate admin tooling may break if it relies on the endpoint from other networks); deploy a WAF rule that rejects requests to jxf_dump_systable.php containing SQL metacharacters or non-numeric values in the gblOrgID parameter (tune carefully to avoid breaking legitimate numeric IDs); enforce database least-privilege so the web application account cannot read sensitive tables or execute DDL, limiting blast radius if the injection is reached; and monitor web and DB logs for anomalous gblOrgID values and unexpected queries originating from the CRM service account. Track VulDB references (https://vuldb.com/vuln/369075, https://vuldb.com/cve/CVE-2026-11456) for any future vendor response, and consider migrating off Chanjet CRM 1.0 if the vendor remains silent.