FeelCRM-OS EUVD-2026-92386

Exploitation requires an authenticated low-privilege account on the target feelcrm-os 1.0.0 instance (CVSS PR:L) and network access to the getMemberByGroups AJAX endpoint (App/Feelcrm/Crm/Controller/AjaxRequestController.class.php). No user interaction is needed (UI:N). The attacker must be able to submit the groups[] array parameter, which is passed unsanitized into a SQL query. Limiting factors: valid credentials are mandatory, limiting purely anonymous exploitation; the product's rare deployment footprint and absence of a vendor fix mean exposure is confined to the small number of self-hosted instances reachable by authenticated users.

This is a genuinely low-priority issue despite being a remotely reachable SQL injection (CWE-89). The signals are internally consistent and point away from urgency: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability with low complexity, but requires authentication (PR:L) and yields only low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no scope change - hence the 2.1 base score. Exploitation maturity is E:P (Proof-of-Concept), matching the 'publicly available exploit code exists' signal; there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The product, feelcrm-os, is an obscure open-source CRM hosted on a tiny GitHub repository, and the vendor has not responded to the report, meaning no patch exists. Net: a real but low-severity authenticated flaw in a rarely deployed product - the POC raises opportunistic risk for the few exposed instances, but this is not a broad-impact priority. Note the discrepancy worth verifying: an unauthenticated-looking 'attack is possible remotely' description is tempered by PR:L in the vector, and the vendor-assigned low C/I/A impacts are conservative for a SQL injection, which can often enable fuller database reads than VC:L suggests.

An authenticated low-privilege user of a feelcrm-os 1.0.0 deployment sends a crafted HTTP request to the getMemberByGroups endpoint, injecting malicious SQL through the groups[] array parameter in AjaxRequestController.class.php. Because public exploit code has been published (VulDB), an attacker can adapt it to extract or tamper with member/CRM records from the backend database with minimal effort.