# CVE-2026-105287: feelec-yishu feelcrm-os SQL injection in getMemberByGroups

Source: https://junglewise.ai/threats/cve-2026-105287-a-flaw-has-been-found-in-feelec-yishu-feelcrm-os-1-0-0-affected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105287 · Severity: medium · CVSS 6.3 · Published 2026-10-05

FeelCRM is an open-source customer relationship management system used by small and medium-sized enterprises to manage leads, customers, and contracts. A SQL injection vulnerability in the getMemberByGroups endpoint allows authenticated users to bypass SQL statement constraints and execute arbitrary database queries, potentially exposing sensitive customer data or system information.

Technologies: [Feelec-Yishu Feelcrm-Os](https://junglewise.ai/threats/technologies/feelcrm-os). Vendors: [Feelec-Yishu](https://junglewise.ai/threats/vendors/feelec-yishu).

## Quick answers

**Is CVE-2026-105287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105287 being exploited in the wild.

**How severe is CVE-2026-105287?** Medium severity, with a CVSS score of 6.3, published 5 October 2026.

**Which products and versions are affected?** Feelec-Yishu Feelcrm-Os 1.0.0.

**Is there a fix for CVE-2026-105287?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105287 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105287?** Check whether you run Feelec-Yishu Feelcrm-Os at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in App/Feelcrm/Crm/Controller/AjaxRequestController.class.php where user-supplied groups[] parameter values are directly interpolated into a find_in_set() SQL expression without proper escaping. An authenticated attacker can inject SQL syntax via the groups[] POST parameter to break out of the quoted string and execute arbitrary queries such as UNION SELECT. The attack requires a valid CRM session and PHP configurations with ENT_COMPAT behavior (PHP 7.x–8.0).

## Affected products

- feelec-yishu feelcrm-os 1.0.0

## Timeline

- 2026-09-14: disclosed: Issue reported on GitHub
- 2026-10-05: advisory: CVE-2026-105287 published

## References

- [https://github.com/feelec-yishu/feelcrm-os/](https://github.com/feelec-yishu/feelcrm-os/)
- [https://github.com/feelec-yishu/feelcrm-os/issues/1](https://github.com/feelec-yishu/feelcrm-os/issues/1)

## Related threats

- [FeelCRM-OS unrestricted file upload in UploadTicketFile endpoint](https://junglewise.ai/threats/cve-2026-105389-a-security-vulnerability-has-been-detected-in-feelec-yishu)
- [FeelCRM OS SQL injection in Member endpoint](https://junglewise.ai/threats/cve-2026-105388-a-weakness-has-been-identified-in-feelec-yishu-feelcrm-os-1-0-0)
- [feelec-yishu feelcrm-os server-side request forgery in getCurlData](https://junglewise.ai/threats/cve-2026-105290-a-vulnerability-was-determined-in-feelec-yishu-feelcrm-os-1-0-0)
- [feelec-yishu FeelCRM OS reflected cross-site scripting in CRM endpoint](https://junglewise.ai/threats/cve-2026-105288-a-vulnerability-has-been-found-in-feelec-yishu-feelcrm-os-1-0-0)