CVE-2025-13788
📋 TL;DR
This CVE describes a SQL injection vulnerability in Chanjet CRM's /tools/upgradeattribute.php file, specifically in the gblOrgID parameter. Attackers can remotely exploit this to execute arbitrary SQL commands on the database. All Chanjet CRM installations up to version 20251106 are affected.
💻 Affected Systems
- Chanjet CRM
📦 What is this software?
Chanjet Crm by Chanjet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized database access leading to data exfiltration, modification of CRM data, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Chanjet for update information or consider workarounds.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
allRestrict access to /tools/upgradeattribute.php via web server configuration or firewall rules.
# Apache: RewriteRule ^/tools/upgradeattribute\.php$ - [F,L]
# Nginx: location ~ ^/tools/upgradeattribute\.php$ { deny all; }
Implement WAF Rules
allDeploy web application firewall rules to detect and block SQL injection attempts targeting the gblOrgID parameter.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user inputs
- Apply principle of least privilege to database accounts used by the application
🔍 How to Verify
Check if Vulnerable:
Check if /tools/upgradeattribute.php exists and accepts gblOrgID parameter. Test with SQL injection payloads in a controlled environment.Check Version:
Check CRM version in admin panel or configuration filesVerify Fix Applied:
Verify the vulnerable file is no longer accessible or that input validation prevents SQL injection.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /tools/upgradeattribute.php with suspicious parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests to /tools/upgradeattribute.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/tools/upgradeattribute.php" AND (param="gblOrgID" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|;)")