The 1.0.0 release of the DefaultFuction Jeson Customer Relationship Management System contains a flaw in the /modules/customers/edit.php file that allows an attacker to manipulate the ID parameter to inject arbitrary SQL code. This injection vulnerability arises from unsafe processing of user input and can enable unauthorized reading or modification of database records. The flaw is a classic instance of SQL injection, providing the attacker with the potential to compromise data confidentiality and integrity.

Only the DefaultFuction Jeson Customer Relationship Management System version 1.0.0 is known to be vulnerable; no other versions are listed as affected.

The security severity score of the vulnerability is 5.3, indicating moderate risk, and its exploitation probability is estimated to be below 1%. The vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list, but a publicly available exploit demonstrates that remote attackers can alter the ID argument to inject SQL. Successful exploitation could allow unauthorized access to sensitive data or the ability to tamper with existing records, potentially leading to data breaches or corruption.