CVE-2025-13788: Chanjet CRM SQL Injection Vulnerability

CVE-2025-13788 Overview

A SQL injection vulnerability has been discovered in Chanjet CRM affecting versions up to 20251106. The vulnerability exists in the /tools/upgradeattribute.php file, where improper handling of the gblOrgID parameter allows attackers to inject malicious SQL statements. This flaw enables remote attackers to manipulate database queries without authentication, potentially compromising data confidentiality, integrity, and availability.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database records, or potentially gain unauthorized access to the underlying system through the vulnerable gblOrgID parameter.

Affected Products

• Chanjet CRM versions up to 20251106
• Chanjet CRM installations using /tools/upgradeattribute.php

Discovery Timeline

• November 30, 2025 - CVE-2025-13788 published to NVD
• December 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-13788

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from insufficient input validation in the Chanjet CRM application. The /tools/upgradeattribute.php endpoint accepts user-supplied input through the gblOrgID parameter without proper sanitization or parameterized query implementation. When attackers submit specially crafted SQL syntax within this parameter, the application incorporates the malicious payload directly into database queries, allowing arbitrary SQL command execution.

The vulnerability is classified under both CWE-89 (SQL Injection) and CWE-74 (Injection), indicating that the application fails to neutralize special elements used in SQL commands. The exploit has been publicly disclosed, and the vendor was contacted about this vulnerability but did not respond.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and sanitization mechanisms for the gblOrgID parameter in the upgradeattribute.php file. The application directly concatenates user-supplied input into SQL queries rather than using prepared statements or parameterized queries, creating a classic SQL injection attack surface.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker can craft malicious HTTP requests to the /tools/upgradeattribute.php endpoint, injecting SQL commands through the gblOrgID parameter. The network-accessible nature of this endpoint combined with the lack of authentication requirements makes this vulnerability particularly concerning for internet-facing Chanjet CRM deployments.

Since this is a SQL injection vulnerability, successful exploitation could allow attackers to:

• Extract sensitive database contents including customer information
• Modify or delete critical business data
• Potentially escalate privileges within the application
• In some configurations, execute operating system commands through database functionality

For detailed technical analysis, refer to the GitHub CVE Issue Report and VulDB entry #333792.

Detection Methods for CVE-2025-13788

Indicators of Compromise

• Unusual HTTP requests targeting /tools/upgradeattribute.php with SQL syntax in the gblOrgID parameter
• Database query logs showing injection patterns such as UNION SELECT, OR 1=1, or comment sequences (--) in organization ID fields
• Unexpected database read or write operations originating from the CRM application
• Error messages in application logs indicating malformed SQL queries

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to /tools/upgradeattribute.php
• Monitor database query logs for anomalous queries containing SQL metacharacters in the gblOrgID context
• Deploy intrusion detection signatures targeting known SQL injection payloads in HTTP POST/GET parameters
• Review web server access logs for suspicious request patterns targeting the vulnerable endpoint

Monitoring Recommendations

• Enable detailed logging for the /tools/ directory endpoints in Chanjet CRM
• Configure database audit logging to capture all queries executed against organizational data tables
• Set up real-time alerting for SQL error messages that may indicate injection attempts
• Monitor for unusual data extraction patterns or bulk database queries

How to Mitigate CVE-2025-13788

Immediate Actions Required

• Restrict network access to the /tools/upgradeattribute.php endpoint using firewall rules or web server configuration
• Implement a web application firewall with SQL injection detection rules for the affected endpoint
• Consider temporarily disabling the vulnerable endpoint if it is not critical for business operations
• Review database user permissions to ensure the CRM application uses least-privilege access

Patch Information

At the time of publication, the vendor (Chanjet) has not responded to disclosure attempts and no official patch is available. Organizations should monitor vendor communications and the VulDB entry for updates regarding patches or official fixes.

Workarounds

• Block external access to /tools/upgradeattribute.php at the network perimeter or web server level
• Implement input validation at the web server level using ModSecurity or similar WAF solutions to filter SQL injection payloads
• If source code modification is possible, implement parameterized queries for the gblOrgID parameter
• Consider network segmentation to limit database access from the CRM application server

# Example Apache .htaccess rule to restrict access to vulnerable endpoint
<Files "upgradeattribute.php">
    Require ip 192.168.1.0/24
    # Alternatively, deny all access:
    # Require all denied
</Files>