CVE-2026-11456: SQL Injection in Chanjet CRM 1.0
| Field | Value |
|---|---|
| CVE ID | CVE-2026-11456 |
| CVSS score | 7.3 |
| Attack vector | Remote over HTTP |
| Authentication required | Unknown from source data; defenders should assume unauthenticated exposure until verified otherwise |
| Patch status | No verified official patch or fixed version identified as of 2026-06-07 |
TL;DR - Remote SQL injection affects Chanjet CRM 1.0 via
/tools/jxf_dump_systable.phpandgblOrgID. - Public exploit availability is explicitly noted by NVD. - No verified fix version is available, so internet-exposed instances should be treated as high priority.
What is CVE-2026-11456?
CVE-2026-11456 is a SQL injection vulnerability in Chanjet CRM 1.0. The public NVD description states that the issue affects /tools/jxf_dump_systable.php in the HTTP GET request handler, where manipulation of the gblOrgID parameter can trigger SQL injection. The attack may be launched remotely, which makes exposure significantly more concerning for any internet-accessible CRM deployment.
The most important practical detail is not just that the bug class is SQL injection, but where it lives: a web-exposed PHP endpoint reachable over HTTP GET. In real environments, this raises the risk of unauthorized data retrieval and potentially broader database abuse depending on how the backend query is constructed and what privileges the application database account holds. There is no vendor-authored root cause analysis available in the source material, so defenders should avoid assuming the blast radius is limited to read-only access.
Technical Notes
A representative request pattern, based on the published vulnerable path and parameter, would look like this:
GET /tools/jxf_dump_systable.php?gblOrgID=1 HTTP/1.1
Host: target.example
User-Agent: Mozilla/5.0
A suspicious variation would be any request where gblOrgID contains SQL metacharacters or boolean/time-based payload structure:
GET /tools/jxf_dump_systable.php?gblOrgID=1%27%20OR%20%271%27%3D%271 HTTP/1.1
Host: target.example
Who is affected?
The only affected version that can be quoted with confidence from the available record is “Chanjet CRM 1.0”. At this time, there is no verified vendor advisory, no officially published support matrix, and no trustworthy fixed-version bulletin available in the provided research. That means defenders should not expand the vulnerable range beyond what is documented, but they also should not assume adjacent builds are safe if they run the same codebase or endpoint.
Because the source material does not provide a broader range such as “before X.Y.Z” or “1.0 through 1.0.n”, the safest operational statement is: the verified affected version range is “Chanjet CRM 1.0”, and the fixed version number is unknown. If you operate a customized or repackaged Chanjet CRM deployment, especially one exposing /tools/jxf_dump_systable.php, you should validate whether this file exists and whether gblOrgID input reaches backend SQL queries without parameterization.
Affected versions and fix status
| Item | Verified status |
|---|---|
| Affected product | Chanjet CRM |
| Verified affected version range | “1.0” |
| Fixed version | Unknown |
| Official vendor advisory | Not found |
| Vendor response status | NVD states the vendor was contacted early but did not respond |
In the absence of a vendor patch statement, defenders should assume that any instance positively identified as Chanjet CRM 1.0 remains vulnerable until compensating controls are in place or the code is independently reviewed.
CVSS score and risk context
NVD rates CVE-2026-11456 at CVSS 7.3. The exact vector string was not available in the provided source material, so it should not be fabricated. Still, the disclosed characteristics are enough to explain why this is operationally important: it is remote, affects a web application endpoint, and has public exploit availability. For SMBs and lean IT teams, that combination often turns a moderate-severity web flaw into a near-term incident risk if the application is internet-facing.
It is also important to separate what is known from what is inferred. SQL injection can enable data disclosure, authentication bypass, record tampering, or even follow-on code execution in some stacks, but those outcomes depend on the query context, DBMS behavior, and backend privileges. None of those deeper impacts have been specifically confirmed in the accessible references for this CVE. Practitioners should therefore prioritize containment based on exposure and exploitability, not on unverified worst-case claims.
Technical Notes
From a defensive risk-ranking perspective, the combination below should drive priority:
Remote web exposure: Yes
Exploit available publicly: Yes
CISA KEV listed: No
Official patch available: Unknown
If your vulnerability management workflow requires a compensating score, flag this as a high-priority externally reachable application issue because patch uncertainty increases operational burden.
Exploitation status
The strongest verified exploitation-related fact is this: NVD explicitly states that a public exploit is available. That means defenders should assume exploit details or reproduction guidance are accessible to attackers, even if the exact proof-of-concept content was not retrievable cleanly during the research session. Public exploit availability materially changes risk, particularly for commodity scanning and opportunistic internet targeting.
At the same time, confirmed exploitation in the wild is not established from the available evidence. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. That does not prove the vulnerability is not being exploited; it only means there is no CISA KEV confirmation to cite. Practically, defenders should treat this as “PoC exists, active exploitation not confirmed.” That is still sufficient reason to hunt for exposure and abuse right away.
Exploitation status summary
| Question | Answer |
|---|---|
| Is exploitation confirmed in the wild? | Not confirmed from available sources |
| Is there a public PoC or exploit? | Yes, NVD says a public exploit is available |
| Is it in CISA KEV? | No |
| Should defenders wait for stronger proof before acting? | No |
What defenders should do next
First, identify whether you run Chanjet CRM 1.0 anywhere in production, test, or forgotten edge deployments. Then confirm whether /tools/jxf_dump_systable.php is reachable internally or externally. Exposure validation should come before lengthy patch research because the current record already establishes a remotely reachable SQL injection with public exploit availability.
Second, put immediate controls in place even if you have not yet observed attacks. Restrict access to the vulnerable path, enable or tighten WAF inspection, review recent logs for gblOrgID abuse, and lower database privileges where feasible. If suspicious requests are found, preserve logs, collect web server and database evidence, and treat the system as potentially compromised until proven otherwise.
Bottom line
CVE-2026-11456 is a remote SQL injection in Chanjet CRM 1.0 affecting /tools/jxf_dump_systable.php via the gblOrgID parameter. The verified affected version range is “1.0”. The fixed version number is unknown. A public exploit is available, but active exploitation in the wild is not confirmed from CISA KEV or the provided source set.
For defenders, the right assumption is simple: if Chanjet CRM 1.0 is exposed and this endpoint is reachable, treat it as exploitable now. Restrict access, monitor for probes, and keep watching for a vendor advisory or independently validated patch information.
For further reading on web application security, consider checking out our articles on What is Log Aggregation? and MacOS Security Basics for IT Teams.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
How to detect attempts and possible compromise
Start with web access logs. Because the vulnerable surface is explicitly identified as /tools/jxf_dump_systable.php and the parameter is gblOrgID, defenders can build focused detections immediately. Look for requests to that path from unusual IP addresses, requests containing SQL metacharacters in the query string, repeated requests with variant payloads, and time-based probing patterns that suggest automated SQL injection tooling.
You should also correlate application logs, reverse proxy logs, WAF telemetry, and database logs if available. SQL injection activity often leaves a visible trail across layers: anomalous request strings at the web tier, SQL syntax errors in PHP or application error logs, and unusual query timing or error events at the database tier. If you cannot inspect the application source, the combination of path-based and parameter-based detections is your fastest way to establish whether you are being probed.
Technical Notes
Example web log patterns to hunt for:
/tools/jxf_dump_systable\.php\?gblOrgID=
Suspicious payload indicators in URI or query strings:
(gblOrgID=).*(%27|\'|%22|--|%23|#|%20or%20|%20and%20|union%20select|sleep\(|benchmark\()
Example Splunk query for access logs:
index=web sourcetype=access_combined uri_path="/tools/jxf_dump_systable.php"
| eval q=coalesce(uri_query, request, url)
| search q="*gblOrgID=*"
| regex q="(?i)(%27|'|--|%23|#|%20or%20|%20and%20|union%20select|sleep\(|benchmark\()"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ip values(user_agent) as user_agent by host, q
Example grep for flat access logs:
grep -E "/tools/jxf_dump_systable\.php.*gblOrgID=" /var/log/nginx/access.log \
| grep -Ei "(%27|'|--|%23|#|%20or%20|%20and%20|union%20select|sleep\(|benchmark\()"
If database logging is enabled, look for SQL syntax errors or sudden bursts of requests tied to the web app account around the same timestamps as suspicious HTTP requests. Exact log strings will depend on the DBMS, which is unknown from the source data.
Mitigation and patching
There is currently no verified official patch and no verified fixed version number that can be quoted from the available sources. Because the research does not surface a vendor bulletin, defenders should not claim that any specific release remediates the issue. Until a trustworthy vendor update exists, the safest position is to apply compensating controls and reduce exposure immediately.
The highest-value mitigation is to remove public access to /tools/jxf_dump_systable.php wherever possible. If the file is not required for normal user workflows, block it at the reverse proxy or web server. If the application must remain online, restrict access to trusted administrative networks, enforce WAF filtering for SQLi payloads, and reduce database account privileges to the minimum required. These steps will not eliminate the vulnerable code path, but they can materially reduce exploitability and blast radius.
Technical Notes
Block access in NGINX:
location = /tools/jxf_dump_systable.php {
allow 10.0.0.0/8;
allow 192.168.0.0/16;
deny all;
}
Reload NGINX:
sudo nginx -t && sudo systemctl reload nginx
Block access in Apache:
<Location "/tools/jxf_dump_systable.php">
Require ip 10.0.0.0/8 192.168.0.0/16
</Location>
Reload Apache:
sudo apachectl configtest && sudo systemctl reload apache2
Emergency workaround if the endpoint is not needed, by renaming the file on a Linux host:
sudo mv /var/www/html/tools/jxf_dump_systable.php /var/www/html/tools/jxf_dump_systable.php.disabled
Example ModSecurity rule to disrupt basic SQLi probes against the vulnerable parameter:
SecRule REQUEST_URI "@streq /tools/jxf_dump_systable.php" \
"id:1145601,phase:2,pass,nolog,chain"
SecRule ARGS:gblOrgID "@rx (?i)(\'|%27|--|#|%23|union\s+select|sleep\(|benchmark\()"
If you maintain the code and can patch locally before a vendor fix exists, parameterize the database query and reject non-numeric gblOrgID values at input validation boundaries. The exact patch depends on the application code, which is not available in the current sources.
References
- NVD: CVE-2026-11456
- GitHub Gist reference listed by NVD: GitHub Gist
- VulDB CVE page: VulDB CVE
- CISA KEV catalog: CISA KEV