An unauthenticated SQL injection vulnerability in Chanjet CRM poses a critical risk to data integrity and confidentiality.

This flaw is a SQL injection vulnerability (CWE-89) located in the /tools/jxf_dump_table_demo.php script. An unauthenticated remote attacker can exploit this by injecting malicious SQL commands into the gblOrgID parameter.

Successful exploitation of this vulnerability allows unauthorized access to or manipulation of the underlying database. Given the CVSS score of 7.3, this represents a high risk: potential impacts include data exfiltration, unauthorized modification of records, and significant compromise of the application backend.

Immediate Action: Since the vendor has not provided a patch, restrict network access to the /tools/ directory and specifically the jxf_dump_table_demo.php file. If the file is not required for daily business operations, it should be removed or disabled immediately.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the gblOrgID parameter. Monitor database query logs for unusual or unauthorized execution patterns.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the specific vulnerable endpoint.

Public Exploit Available: Yes, a published proof of concept exists, attributed to the technical documentation provided in the linked GitHub issue.

This vulnerability presents a clear and present danger due to the ease of exploitation and the availability of a public proof-of-concept. Organizations utilizing Chanjet CRM must prioritize restricting access to the vulnerable script and implementing robust WAF filtering to prevent unauthorized database interactions until a formal vendor patch is released.