CVE-2026-105287: feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection
A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges. Exploitation can be performed remotely and does not require user interaction.
Is exploit code available?
Yes. The available data states that an exploit has been published and may be used.
Which input and endpoint are implicated?
The issue affects the getMemberByGroups endpoint in App/Feelcrm/Crm/Controller/AjaxRequestController.class.php. SQL injection is triggered through manipulation of the groups[] argument.
Is a vendor fix available?
No vendor response or fix is identified in the available data. The project was notified through an issue report but had not responded at the time of publication.