FeelCRM OS CVE-2026-105388

Requires an authenticated low-privileged account (CVSS PR:L) that can reach the Member Endpoint and invoke the index function of App/Feelcrm/Index/Controller/MemberController.class.php, then supply an attacker-controlled group_id parameter. Exploitation is remote and needs no user interaction (AV:N/UI:N) and no special non-default configuration is cited in the description - the injectable code path appears present in the standard application. The primary limiting factor is the authentication requirement; this is not an unauthenticated flaw. Affected version is feelcrm-os 1.0.0 per the CPE; no fixed version is available as the vendor has not responded.

This is a low-to-moderate priority issue despite being a SQL injection flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L), so an attacker must already hold a valid authenticated account on the feelcrm-os application. The impact metrics are only Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which is unusually conservative for a SQLi and suggests the VulDB assessor judged limited data exposure rather than full database compromise - in practice, an unsanitized group_id in a member query could enable broader data extraction than VC:L implies, so the real confidentiality impact may be understated. Exploitation maturity is E:P (proof-of-concept), consistent with publicly available exploit code existing but no evidence of active exploitation. There is no CISA KEV listing and no EPSS score provided in the input, so widespread automated exploitation cannot be inferred. The dominant mitigating factors are the authentication requirement and the apparent obscurity of the product. Net: a real but contained vulnerability - patch when able, but not an emergency relative to internet-wide critical flaws.

An attacker with a low-privileged authenticated account on a feelcrm-os 1.0.0 instance sends a crafted request to the Member Endpoint, injecting malicious SQL through the group_id parameter handled by MemberController's index function. Because public proof-of-concept exploit code exists (referenced via the vendor GitHub issue), an attacker can adapt it to extract or manipulate member data from the backend database. The low attack complexity means no special timing or conditions are required once valid credentials are held.