CVE-2026-84111— Chanjet CRM jxf_dump_table.php sql injection
Quick assessment
Affected
Chanjet CRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Chanjet CRM 20260707 及更早版本中发现了一个漏洞。该问题影响了文件 中某些未知的处理逻辑。对参数 的操作会导致 SQL 注入漏洞。该漏洞可被远程利用，且对应的利用代码已经公开，可能会被实际使用。相关厂商曾就此次漏洞披露提前联系，但未作出任何回应。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84111
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chanjet CRM jxf_dump_table.php sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84111
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84111
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84111 (1)
-
🔗 CVE-2026-84111 in Chanjet third-party-advisory
Security Blog Posts for CVE-2026-84111 (1)
-
🔗 Chanjet CRM SQL Injection Vulnerability Report · Issue #1 · LittleRedBean/CVE Read full article exploit issue-tracking
Other References for CVE-2026-84111 (2)
-
🔗 Submit #882212: Chanjet CRM V1.0 SQL Injection third-party-advisory
-
IV. Related Vulnerabilities
Same product: CRM
-
CVE-2026-58411
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsan -
CVE-2026-58410
ChurchCRM: Improper object-level authorization allows low-pr -
CVE-2026-58409
ChurchCRM: Authenticated Remote Code Execution (RCE) via Mal -
CVE-2026-58408
ChurchCRM : Broken Access Control in `CSVCreateFile.php` All -
CVE-2026-11456
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injec
Same vendor: Chanjet
-
CVE-2026-11456
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injec -
CVE-2025-14190
Chanjet TPlus sql injection -
CVE-2025-14189
Chanjet CRM jxf_dump_table_demo.php sql injection -
CVE-2025-13788
Chanjet CRM upgradeattribute.php sql injection -
CVE-2025-7915
Chanjet CRM Login Page mailinactive.php sql injection
Same weakness: CWE-89
-
CVE-2026-84153
Xinhu Rainrock RockOA index.php toaddval sql injection -
CVE-2026-18630
SQL Injection in TMT Machine's Talassoft Industrial Manageme -
CVE-2026-84109
Xinhu Rainrock RockOA webmainAction.php getOrder sql injecti -
CVE-2026-18210
SQL Injection in TRtek Technological Products's Store -
CVE-2026-18765
SQL Injection in Teracity Sotware's Teracity E-OSB Platform
V. Comments for CVE-2026-84111
No comments yet