CVE-2021-48008: Chanjet Information Technology Co., Ltd CRM

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Affected products

• Chanjet Information Technology Co., Ltd CRM: any version

Published 2026-09-18. Last modified 2026-09-24.