PT-2025-48390 · Chanjet · Chanjet Crm

Hala · Published 2025-11-30 · Updated 2025-12-26 · CVE-2025-13788

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chanjet CRM versions prior to 20251107

Description A flaw exists in Chanjet CRM that allows for SQL injection. The issue is located in the /tools/upgradeattribute.php file, specifically within an unknown function. Manipulation of the gblOrgID parameter can trigger the injection. The attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 20251107 should be updated. As a temporary workaround, restrict access to the /tools/upgradeattribute.php file. Avoid using the gblOrgID parameter in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-13788

Affected Products

Chanjet Crm

References · 12

• 🔥 https://github.com/Bellingham-max/CVE/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13788 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13788 · Vendor Advisory
• https://vuldb.com/?ctiid.333792 · Note
• https://t.me/CVEtracker/38487 · Telegram Post
• https://twitter.com/cracbot/status/1996897383641436625 · Twitter Post
• https://twitter.com/SecReportCVE/status/2004614682645069854 · Twitter Post
• https://twitter.com/CVEnew/status/1995125016258924765 · Twitter Post
• https://vuldb.com/?submit.690084 · Note
• https://t.me/cveNotify/144345 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995125595378798761 · Twitter Post
• https://vuldb.com/?id.333792 · Note