| शीर्षक | feelec-yishu feelcrm-os 1.0.0 SQL Injection |
|---|
| विवरण | FeelCRM 1.0.0 is affected by an authenticated SQL injection vulnerability in the `/Crm/AjaxRequest/getMemberByGroups` endpoint. The `groups[]` POST parameter is directly interpolated into a `find_in_set('{$v}',group_id)` SQL expression and processed as a raw complex query condition without parameterization or numeric validation. An authenticated attacker can submit `groups[]=1111', group_id) ) UNION SELECT 1,version(),3 -- ` to terminate the original SQL expression and execute a UNION-based injection. The injected `version()` result is returned through the JSON response in the `name` field as `8.0.46-0ubuntu0.24.04.4`, confirming SQL execution and information disclosure. The vulnerability requires a valid CRM/Index session and is dependent on PHP configurations where the single quote is not encoded by the default input filter. Exploitation may allow disclosure of additional database information and may bypass the intended tenant or department filtering. |
|---|
| स्रोत | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/1 |
|---|
| उपयोगकर्ता | liaoxijun10086 (UID 101151) |
|---|
| सबमिशन | 14/09/2026 02:15 PM (21 दिन पहले) |
|---|
| संयम | 05/10/2026 12:44 AM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413468 [feelec-yishu feelcrm-os 1.0.0 getMemberByGroups Endpoint AjaxRequestController.class.php groups[] SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|