PT-2025-49402 · Chanjet · Chanjet Crm

Routing_Love · Published 2025-12-07 · Updated 2025-12-11 · CVE-2025-14189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chanjet CRM versions prior to 20251122

Description A SQL injection issue exists in Chanjet CRM. The issue is related to the manipulation of the gblOrgID parameter within the /tools/jxf dump table demo.php file. This manipulation affects an unknown function. The attack can be performed remotely. The exploit is publicly available.

Recommendations Versions prior to 20251122 should be updated. Restrict access to the /tools/jxf dump table demo.php file. Avoid using the gblOrgID parameter until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14189

Affected Products

Chanjet Crm

References · 11

• 🔥 https://github.com/hacker-routing/cve/issues/2 · Exploit
• 🔥 https://github.com/hacker-routing/cve/issues/2#issue-3646348225 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14189 · Security Note
• https://twitter.com/cracbot/status/1999071737888248081 · Twitter Post
• https://vuldb.com/?id.334609 · Note
• https://vuldb.com/?ctiid.334609 · Note
• https://twitter.com/CVEnew/status/1997631593616412987 · Twitter Post
• https://t.me/CVEtracker/39041 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1997647728281604464 · Twitter Post
• https://t.me/cveNotify/145027 · Telegram Post
• https://vuldb.com/?submit.699133 · Note