PT-2026-23626 · Defaultfuction · Jeson Customer Relationship Management System

Practice · Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-3616

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DefaultFuction Jeson Customer Relationship Management System version 1.0.0

Description A SQL injection issue exists in DefaultFuction Jeson Customer Relationship Management System version 1.0.0. The issue is located in the /modules/customers/edit.php file. Manipulation of the ID argument can lead to SQL injection. The attack can be initiated remotely. The exploit is publicly available.

Recommendations Install the patch f0e991870e9d33701cca3a1d0fd4eec135af01a6 to address this issue.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-3616

Affected Products

Jeson Customer Relationship Management System

References · 12

• 🔥 https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3616 · Security Note
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6 · Patch
• https://osv.dev/vulnerability/CVE-2026-3616 · Vendor Advisory
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567 · Note
• https://vuldb.com/?ctiid.349234 · Note
• https://twitter.com/cyberbivash/status/2029786062470496702 · Twitter Post
• https://vuldb.com/?submit.765096 · Note
• https://twitter.com/VulmonFeeds/status/2029786870507266307 · Twitter Post
• https://t.me/cveNotify/154452 · Telegram Post
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1 · Note
• https://vuldb.com/?id.349234 · Note