CVE-2026-3616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3616", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-05T18:42:24.952Z", "datePublished": "2026-03-06T01:32:08.323Z", "dateUpdated": "2026-03-09T15:30:41.673Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-06T01:32:08.323Z"}, "title": "DefaultFuction Jeson Customer Relationship Management System edit.php sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "DefaultFuction", "product": "Jeson Customer Relationship Management System", "versions": [{"version": "1.0.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-05T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-05T19:47:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Practice (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.349234", "name": "VDB-349234 | DefaultFuction Jeson Customer Relationship Management System edit.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349234", "name": "VDB-349234 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765096", "name": "Submit #765096 | DefaultFuction Jeson CRM V1.0.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567", "tags": ["issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T15:30:33.869901Z", "id": "CVE-2026-3616", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T15:30:41.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3616", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T15:30:33.869901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T15:30:38.065Z"}}], "cna": {"tags": ["x_open-source"], "title": "DefaultFuction Jeson Customer Relationship Management System edit.php sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "Practice (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "DefaultFuction", "product": "Jeson Customer Relationship Management System", "versions": [{"status": "affected", "version": "1.0.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-05T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-05T19:47:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349234", "name": "VDB-349234 | DefaultFuction Jeson Customer Relationship Management System edit.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349234", "name": "VDB-349234 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765096", "name": "Submit #765096 | DefaultFuction Jeson CRM V1.0.0 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567", "tags": ["issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-06T01:32:08.323Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3616", "state": "PUBLISHED", "dateUpdated": "2026-03-09T15:30:41.673Z", "dateReserved": "2026-03-05T18:42:24.952Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-06T01:32:08.323Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Jeson Customer Relationship Management System", "vendor": "DefaultFuction", "versions": [{"status": "affected", "version": "1.0.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en el sistema DefaultFuction Jeson Customer Relationship Management 1.0.0. Afectada es una funci\u00f3n desconocida del archivo /modules/customers/edit.PHP. Realizar una manipulaci\u00f3n del argumento ID resulta en inyecci\u00f3n SQL. El ataque puede ser iniciado remotamente. El exploit es ahora p\u00fablico y puede ser usado. El parche se llama f0e991870e9d33701cca3a1d0fd4eec135af01a6. Se sugiere instalar un parche para abordar este problema."}], "id": "CVE-2026-3616", "lastModified": "2026-06-17T10:43:52.623", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3616", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T15:30:33.869901Z", "version": "2.0.3"}}]}, "published": "2026-03-06T03:15:52.220", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6"}, {"source": "cna@vuldb.com", "url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1"}, {"source": "cna@vuldb.com", "url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812"}, {"source": "cna@vuldb.com", "url": "https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.349234"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.349234"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.765096"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Jeson Customer Relationship Management System", "source": "cna", "vendor": "DefaultFuction"}, "product": "jeson_customer_relationship_management_system", "vendor": "defaultfuction"}], "analysis": {"en": {"generated_at": "2026-04-17T12:29:07.113230+00:00", "value": {"mitigation_remediation": ["Apply the patch identified by commit f0e991870e9d33701cca3a1d0fd4eec135af01a6 to fix the flaw", "Upgrade to the latest version of the Jeson Customer Relationship Management System where the issue has been resolved", "Rewrite the code to use parameterized queries and perform strict validation or sanitization of the ID input before database usage", "Limit access to the edit module so that only authorized users can reach it and regularly review logs for suspicious SQL activity"], "summary": {"action": "Immediate Patch", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "Only the DefaultFuction Jeson Customer Relationship Management System version 1.0.0 is known to be vulnerable; no other versions are listed as affected.", "description_and_impact": "The 1.0.0 release of the DefaultFuction Jeson Customer Relationship Management System contains a flaw in the /modules/customers/edit.php file that allows an attacker to manipulate the ID parameter to inject arbitrary SQL code. This injection vulnerability arises from unsafe processing of user input and can enable unauthorized reading or modification of database records. The flaw is a classic instance of SQL injection, providing the attacker with the potential to compromise data confidentiality and integrity.", "risk_and_exploitability": "The security severity score of the vulnerability is 5.3, indicating moderate risk, and its exploitation probability is estimated to be below 1%. The vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list, but a publicly available exploit demonstrates that remote attackers can alter the ID argument to inject SQL. Successful exploitation could allow unauthorized access to sensitive data or the ability to tamper with existing records, potentially leading to data breaches or corruption."}}}}, "created": "2026-03-06T14:56:13.228376+00:00", "updated": "2026-04-17T12:30:06.283483+00:00", "vendors": ["defaultfuction", "defaultfuction$PRODUCT$jeson_customer_relationship_management_system"]}