Unauthenticated SQL Injection in Chanjet CRM (CVE-2021-48008)

Chanjet CRM is affected by an unauthenticated SQL injection vulnerability identified as CVE-2021-48008. The flaw exists within the application's webservice endpoint, specifically due to improper handling of the 'site_id' GET parameter. An unauthenticated remote attacker can inject arbitrary SQL commands by manipulating this parameter, bypassing input sanitization to interact directly with the backend database.

The vulnerability is categorized as a high-severity risk (CVSS v3.1 base score 7.5) because it does not require user authentication to trigger. Successful exploitation allows for UNION-based SQL injection, which can lead to the unauthorized extraction of sensitive information, such as user credentials, customer data, or configuration details. The Shadowserver Foundation reported observing exploitation attempts in the wild starting as early as October 18, 2023. Defenders should prioritize auditing web server logs for suspicious requests targeting the webservice endpoint with SQL-specific syntax.

Impact

The vulnerability poses a significant risk to organizational confidentiality. If exploited, an attacker can conduct unauthorized queries against the application database, leading to the full exfiltration of stored business intelligence or personally identifiable information (PII). Given the public disclosure and observed in-the-wild activity, there is a high probability of automated exploitation by opportunistic threat actors scanning for vulnerable instances.

Recommendation

• Audit web access logs for requests to the webservice endpoint containing SQL injection patterns such as 'UNION SELECT', 'ORDER BY', or common SQL comment markers.
• Implement strict input validation or parameterization on all GET and POST parameters within the Chanjet CRM webservice API.
• Patch affected Chanjet CRM instances to the latest vendor-supplied version to remediate the lack of input sanitization in the 'site_id' parameter.
• Use a Web Application Firewall (WAF) to block incoming requests containing classic SQL injection payloads directed at the 'site_id' parameter.