CVE-2025-7915: Chanjet CRM SQL Injection Vulnerability

CVE-2025-7915 Overview

A critical SQL injection vulnerability has been identified in Chanjet CRM version 1.0. The vulnerability exists within the Login Page component, specifically in the /mail/mailinactive.php file. This flaw allows remote attackers to manipulate database queries through improper input handling, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability without authentication to compromise database integrity and confidentiality in Chanjet CRM deployments.

Affected Products

• Chanjet CRM 1.0
• chanjet chanjet_crm (cpe:2.3:a:chanjet:chanjet_crm:1.0:::::::*)

Discovery Timeline

• 2025-07-21 - CVE-2025-7915 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-7915

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the authentication mechanism in Chanjet CRM's Login Page component. The vulnerable endpoint /mail/mailinactive.php fails to properly sanitize user-supplied input before incorporating it into SQL queries. This injection flaw (CWE-74) allows attackers to insert malicious SQL statements that are executed by the backend database server.

The vulnerability is remotely exploitable and requires no authentication or user interaction, making it particularly dangerous for internet-facing CRM deployments. Successful exploitation could enable attackers to extract sensitive customer data, modify business records, or escalate privileges within the application.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the mailinactive.php script. The application directly incorporates user-controlled parameters into SQL queries without proper parameterized queries or prepared statements, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack is network-based and can be executed remotely against any accessible Chanjet CRM installation. An attacker can craft malicious HTTP requests targeting the /mail/mailinactive.php endpoint with specially crafted input parameters containing SQL injection payloads. Since the vulnerability exists in the Login Page component, authentication is not required to exploit this flaw.

The vulnerability has been publicly disclosed, with technical details available through GitHub CVE Documentation and tracked in VulDB #317030. Organizations running Chanjet CRM 1.0 should assess their exposure immediately.

Detection Methods for CVE-2025-7915

Indicators of Compromise

• Unusual SQL error messages appearing in web application logs from /mail/mailinactive.php
• Abnormal database query patterns or execution times originating from the CRM application
• Unexpected database modifications, user account changes, or data exfiltration attempts
• HTTP requests to /mail/mailinactive.php containing SQL metacharacters such as single quotes, semicolons, or UNION statements

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the /mail/mailinactive.php endpoint
• Implement database activity monitoring to identify anomalous query structures or unauthorized data access
• Configure application-level logging to capture all authentication attempts and flag suspicious input patterns
• Use intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Monitor HTTP traffic to Chanjet CRM for requests containing SQL injection payloads in parameters
• Enable detailed database query logging and review for suspicious query patterns including UNION-based, error-based, or time-based injection techniques
• Set up alerts for authentication failures or unusual login activity from the CRM application
• Track network connections from the CRM server to external destinations that may indicate data exfiltration

How to Mitigate CVE-2025-7915

Immediate Actions Required

• Restrict network access to the Chanjet CRM application to trusted IP addresses only
• Implement WAF rules to filter SQL injection attempts targeting /mail/mailinactive.php
• Review database logs for signs of prior exploitation and assess data integrity
• Consider taking the affected CRM offline if it contains sensitive data until a patch is available

Patch Information

No vendor patch information is currently available for this vulnerability. Organizations should monitor Chanjet's official channels for security updates. Technical details and tracking information are available through VulDB CTI ID #317030 and VulDB Submission #618873.

Workarounds

• Implement input validation at the web server or reverse proxy level to sanitize requests to the vulnerable endpoint
• Deploy a WAF with SQL injection detection capabilities in front of the CRM application
• Restrict database user permissions to limit the impact of potential SQL injection attacks
• Consider network segmentation to isolate the CRM system from critical infrastructure

# Example WAF rule to block SQL injection attempts (ModSecurity format)
SecRule REQUEST_URI "/mail/mailinactive.php" \
    "id:1001,phase:2,deny,status:403,\
    chain"
SecRule ARGS "@detectSQLi" \
    "msg:'SQL Injection attempt blocked on Chanjet CRM'"