Description
A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument group_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection enabling unauthorized data access
Action: Apply Patch
AI Analysis

Impact

A weakness was identified in the index function of MemberController.class.php in the Member Endpoint component of FeelCRM OS. Manipulating the group_id argument allows an attacker to inject arbitrary SQL, potentially exposing, modifying or deleting data in the underlying database. This flaw relies on improper input validation and could compromise confidentiality and integrity for anyone with access to the affected endpoint.

Affected Systems

The vulnerability affects feelec-yishu FeelCRM OS version 1.0.0. Users running this baseline release are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates medium risk. The exploit is publicly available and can be triggered remotely by any user who can send a crafted request to the MemberController index, as the project has not released a fix. Because no EPSS score is reported, the exact exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 5, 2026 at 20:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched or newer release of FeelCRM OS once the vendor releases an update that removes the injection vector.
  • If an update is not yet available, implement server-side validation to ensure that group_id accepts only numeric values before it is used in a query.
  • Restrict access to the MemberController index endpoint by applying authentication or firewall rules, limiting exposure to trusted users.
  • Continuously monitor application logs for anomalous SQL statements or error messages that may indicate attempted exploitation.

Generated by OpenCVE AI on October 5, 2026 at 20:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument group_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection
First Time appeared Feelec-yishu
Feelec-yishu feelcrm-os
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*
Vendors & Products Feelec-yishu
Feelec-yishu feelcrm-os
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Feelec-yishu Feelcrm-os
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T13:39:20.160Z

Reserved: 2026-10-05T10:31:17.995Z

Link: CVE-2026-105388

cve-icon Vulnrichment

Updated: 2026-10-06T13:39:16.424Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T20:17:10.393

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105388

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T21:45:19Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')