Feelcrm Os
Monthly
Unrestricted file upload in feelec-yishu FeelCRM-OS 1.0.0 allows an authenticated, low-privileged user to write arbitrary files to the server through the UploadTicketFile endpoint at App/Feelcrm/Crm/Controller/UploadController.class.php by manipulating the cmd argument. The issue is reachable remotely over the network, requires no user interaction, and publicly available exploit code exists, but exploitation is gated on holding a valid low-privileged account (CVSS PR:L) and is confined to version 1.0.0 of this narrowly deployed CRM product, so overall risk is low. The vendor/project was notified through an issue report and has not responded, and there is no indication of confirmed active exploitation (no CISA KEV listing).
SQL injection in FeelCRM OS 1.0.0 allows an authenticated, low-privileged remote attacker to execute arbitrary SQL by manipulating the group_id argument handled by the index function of App/Feelcrm/Index/Controller/MemberController.class.php, exposing or altering member-related data. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P, and the original report is a public GitHub issue), but there is no evidence of confirmed active exploitation (CISA KEV). Because exploitation requires a valid low-privileged account (CVSS PR:L) and yields only low confidentiality, integrity, and availability impact, this is a low-to-moderate priority issue rather than an unauthenticated critical flaw.
Reflected cross-site scripting in FeelCRM OS 1.0.0 allows unauthenticated remote attackers to inject arbitrary script through the keyword parameter in the Department Search endpoint handled by GroupController::index, requiring a victim to visit a crafted link. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the independent assessment rates this as low severity with vendor CVSS 4.0 base score 2.1 and assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The primary risk is script execution in the victim's browser context, especially if the victim holds an authenticated CRM session.
Server-side request forgery in feelec-yishu feelcrm-os 1.0.0 allows unauthenticated remote attackers to make the application's server issue attacker-controlled HTTP requests through the getCurlData endpoint in App/Feelcrm/Index/Controller/GoogleController.class.php, by manipulating the 'url' argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely reachable, low-complexity and requires no authentication or user interaction, while impact is uniformly LOW (VC:L/VI:L/VA:L) with no scope change, making it a limited-impact SSRF rather than a full internal pivot or credential-theft primitive. Publicly available exploit code exists and the issue was reported to the project, which has not yet responded with a fix; no confirmed active exploitation (CISA KEV) has been observed.
Stored cross-site scripting in FeelCRM-OS 1.0.0 lets an authenticated low-privileged user inject arbitrary script through the customer_form[remark] field of the Create Customer endpoint, which is persisted after htmlspecialchars_decode processing and executes when another user views the affected customer record. Publicly available exploit code exists (referenced through the vendor's GitHub issue tracker and VulDB), but there is no confirmed active exploitation via CISA KEV and no vendor-released patch has been identified. The issue is a low-to-moderate priority item because exploitation requires valid credentials, a second user to render the stored record, and the product is niche with no known default internet-facing deployment.
Authenticated SQL injection in feelec-yishu feelcrm-os 1.0.0 lets a low-privileged logged-in user run attacker-controlled SQL through the groups[] array parameter handled by the getMemberByGroups AJAX endpoint in App/Feelcrm/Crm/Controller/AjaxRequestController.class.php. Publicly available exploit code exists (the reporter published details in the project's GitHub issue tracker at https://github.com/feelec-yishu/feelcrm-os/issues/1), but there is no indication of confirmed active exploitation and the flaw is not in CISA KEV. The vendor's CVSS 4.0 score is 2.1 while an independent assessment rates it a genuinely low-priority, remotely reachable SQLi constrained by mandatory valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), no user interaction, and the product's rare self-hosted deployment footprint.
Unrestricted file upload in feelec-yishu FeelCRM-OS 1.0.0 allows an authenticated, low-privileged user to write arbitrary files to the server through the UploadTicketFile endpoint at App/Feelcrm/Crm/Controller/UploadController.class.php by manipulating the cmd argument. The issue is reachable remotely over the network, requires no user interaction, and publicly available exploit code exists, but exploitation is gated on holding a valid low-privileged account (CVSS PR:L) and is confined to version 1.0.0 of this narrowly deployed CRM product, so overall risk is low. The vendor/project was notified through an issue report and has not responded, and there is no indication of confirmed active exploitation (no CISA KEV listing).
SQL injection in FeelCRM OS 1.0.0 allows an authenticated, low-privileged remote attacker to execute arbitrary SQL by manipulating the group_id argument handled by the index function of App/Feelcrm/Index/Controller/MemberController.class.php, exposing or altering member-related data. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P, and the original report is a public GitHub issue), but there is no evidence of confirmed active exploitation (CISA KEV). Because exploitation requires a valid low-privileged account (CVSS PR:L) and yields only low confidentiality, integrity, and availability impact, this is a low-to-moderate priority issue rather than an unauthenticated critical flaw.
Reflected cross-site scripting in FeelCRM OS 1.0.0 allows unauthenticated remote attackers to inject arbitrary script through the keyword parameter in the Department Search endpoint handled by GroupController::index, requiring a victim to visit a crafted link. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the independent assessment rates this as low severity with vendor CVSS 4.0 base score 2.1 and assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The primary risk is script execution in the victim's browser context, especially if the victim holds an authenticated CRM session.
Server-side request forgery in feelec-yishu feelcrm-os 1.0.0 allows unauthenticated remote attackers to make the application's server issue attacker-controlled HTTP requests through the getCurlData endpoint in App/Feelcrm/Index/Controller/GoogleController.class.php, by manipulating the 'url' argument. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely reachable, low-complexity and requires no authentication or user interaction, while impact is uniformly LOW (VC:L/VI:L/VA:L) with no scope change, making it a limited-impact SSRF rather than a full internal pivot or credential-theft primitive. Publicly available exploit code exists and the issue was reported to the project, which has not yet responded with a fix; no confirmed active exploitation (CISA KEV) has been observed.
Stored cross-site scripting in FeelCRM-OS 1.0.0 lets an authenticated low-privileged user inject arbitrary script through the customer_form[remark] field of the Create Customer endpoint, which is persisted after htmlspecialchars_decode processing and executes when another user views the affected customer record. Publicly available exploit code exists (referenced through the vendor's GitHub issue tracker and VulDB), but there is no confirmed active exploitation via CISA KEV and no vendor-released patch has been identified. The issue is a low-to-moderate priority item because exploitation requires valid credentials, a second user to render the stored record, and the product is niche with no known default internet-facing deployment.
Authenticated SQL injection in feelec-yishu feelcrm-os 1.0.0 lets a low-privileged logged-in user run attacker-controlled SQL through the groups[] array parameter handled by the getMemberByGroups AJAX endpoint in App/Feelcrm/Crm/Controller/AjaxRequestController.class.php. Publicly available exploit code exists (the reporter published details in the project's GitHub issue tracker at https://github.com/feelec-yishu/feelcrm-os/issues/1), but there is no indication of confirmed active exploitation and the flaw is not in CISA KEV. The vendor's CVSS 4.0 score is 2.1 while an independent assessment rates it a genuinely low-priority, remotely reachable SQLi constrained by mandatory valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), no user interaction, and the product's rare self-hosted deployment footprint.