CVE-2021-48008— Chanjet CRM SQL Injection via get_usedspace.php
Quick assessment
Affected
Chanjet Information Technology Co., Ltd. CRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
畅捷通CRM 存在一个未经身份验证的 SQL 注入漏洞，允许远程攻击者通过操控 Web 服务接口中的 GET 参数来执行任意 SQL 查询。由于缺乏输入净化或参数化处理，攻击者可以利用基于 UNION 的注入技术，从底层数据库中提取敏感数据。该漏洞的利用证据最早由 Shadowserver 基金会于 2023 年 10 月 18 日观察到。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Chanjet Information Technology Co., Ltd. | CRM | * |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-48008
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chanjet CRM SQL Injection via get_usedspace.php
Source: CVE Program / CVE List V5
Vulnerability Description
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Chanjet Information Technology Co., Ltd. | CRM | * | - |
|
II. Public POCs for CVE-2021-48008
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-48008
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-48008 (1)
-
🔗 https://www.cnvd.org.cn/flaw/show/CNVD-2021-12845 third-party-advisory
Proof of Concept for CVE-2021-48008 (1)
Other References for CVE-2021-48008 (2)
-
🔗 Chanjet CRM SQL Injection via get_usedspace.php | Advisories | VulnCheck third-party-advisory
-
🔗 畅捷通官网 product
IV. Related Vulnerabilities
Same product: CRM
-
CVE-2026-92418
ChangeWeDer crm Save Endpoint customer.serve.js cross site s -
CVE-2026-92402
ChangeWeDer crm top.upstudy.crm.controller.UserController Us -
CVE-2026-92401
ChangeWeDer crm improper authentication -
CVE-2026-86172
DefaultFuction CRM delete.php sql injection -
CVE-2026-86171
DefaultFuction CRM delete.php sql injection
Same weakness: CWE-89
-
CVE-2026-76899
CordysCRM: Authenticated SQL injection via `sort.name` on `P -
CVE-2026-84239
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84105
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-52745
CordysCRM: Customer Public Pool Sorting Field SQL Injection -
CVE-2026-84082
IBM Guardium Data Protection is affected by multiple vulnera
V. Comments for CVE-2021-48008
No comments yet