CVE-2026-105388 in feelcrm-os
Summary
by MITRE • 10/05/2026
A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument group_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The identified vulnerability in feelec-yishu feelcrm-os version 1.0.0 represents a critical security flaw within the application's member management subsystem, specifically located in the Member Endpoint component. The root cause resides in the index function of the file App/Feelcrm/Index/Controller/MemberController.class.php. This module is responsible for handling requests related to user group associations and membership details, which are often sensitive areas requiring strict input validation due to their direct interaction with backend databases. The specific weakness involves a failure to properly sanitize or parameterize an argument named group_id before it is incorporated into SQL queries executed by the application server.
This technical flaw constitutes a classic SQL injection vulnerability, categorized under CWE-89 in the Common Weakness Enumeration standard. When the application receives a request containing the group_id parameter, it directly concatenates this user-supplied input into an SQL statement without employing prepared statements or adequate escaping mechanisms. This lack of separation between code and data allows an attacker to inject malicious SQL syntax that alters the intended logic of the database query. Because the vulnerability is present in a controller method accessible via HTTP requests, the attack vector is remote, requiring no prior authentication if the endpoint does not enforce strict access controls on this specific action, or allowing exploitation by any authenticated user who can manipulate their group_id parameter during legitimate interactions with the system.
The operational impact of exploiting this SQL injection vulnerability is severe and multifaceted. An attacker could potentially bypass authentication mechanisms to gain unauthorized access to administrative functions if the injected code manipulates login queries. More critically, successful exploitation allows for arbitrary data extraction from the database, including sensitive user credentials, personal identifiable information, and proprietary business logic stored within the CRM system. Furthermore, depending on the underlying Database Management System configuration, an attacker might execute commands that compromise the integrity of the entire server infrastructure by writing files to disk or executing operating system-level commands through extended SQL procedures. The availability of public exploits significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and targeted attacks against instances running this specific version of the software.
The fact that the project maintainers have been notified via an issue report but have not yet responded highlights a critical gap in supply chain security and vendor responsiveness. For organizations relying on feelcrm-os 1.0.0, this lack of patch availability necessitates immediate defensive measures to mitigate risk until an official fix is released. Security teams should prioritize implementing Web Application Firewall rules that detect common SQL injection patterns associated with the group_id parameter. Additionally, reviewing access control lists to ensure that only authorized roles can invoke the MemberController index function provides a layer of defense in depth.
To align with industry best practices for vulnerability management and threat modeling, this incident underscores the importance of adhering to secure coding standards such as those outlined by OWASP. Developers must enforce strict input validation on all user-supplied data, particularly identifiers used in database queries. The use of parameterized queries or object-relational mapping tools that automatically handle escaping is essential to prevent SQL injection attacks. Furthermore, organizations should conduct regular code reviews and static application security testing focused on identifying improper argument handling in controller layers. Until the vendor provides a patched version, deploying compensating controls such as network segmentation, strict input filtering at the proxy level, and enhanced monitoring for anomalous database query patterns are recommended strategies to protect against exploitation of this known vulnerability.