# CVE-2026-105388: FeelCRM OS SQL injection in Member endpoint

Source: https://junglewise.ai/threats/cve-2026-105388-a-weakness-has-been-identified-in-feelec-yishu-feelcrm-os-1-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105388 · Severity: medium · CVSS 6.3 · Published 2026-10-05

FeelCRM is an open-source customer management system used by small and medium enterprises to track leads, customers, and contracts. An authenticated attacker with member list access can inject malicious SQL code through the group_id parameter to extract sensitive database information. This allows an insider or compromised account to view database version details and potentially access customer data or other confidential information.

Technologies: [Feelec-Yishu Feelcrm-Os](https://junglewise.ai/threats/technologies/feelcrm-os). Vendors: [Feelec-Yishu](https://junglewise.ai/threats/vendors/feelec-yishu).

## Quick answers

**Is CVE-2026-105388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105388 being exploited in the wild.

**How severe is CVE-2026-105388?** Medium severity, with a CVSS score of 6.3, published 5 October 2026.

**Which products and versions are affected?** Feelec-Yishu Feelcrm-Os 1.0.0.

**Is there a fix for CVE-2026-105388?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105388 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105388?** Check whether you run Feelec-Yishu Feelcrm-Os at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Member endpoint in MemberController.class.php accepts a user-supplied group_id parameter and concatenates it directly into a find_in_set() SQL expression without integer conversion or validation. An authenticated attacker can terminate the quoted value and inject arbitrary SQL expressions, which are then processed as raw complex conditions by ThinkPHP's database driver without parameter binding or escaping. Error-based SQL injection via MySQL extractvalue() allows the attacker to exfiltrate database version information; other injection techniques (boolean, time-based) may work depending on error handling.

## Affected products

- feelec-yishu FeelCRM OS 1.0.0

## Timeline

- 2026-09-14: disclosed: Issue reported on GitHub
- 2026-10-05: advisory

## References

- [https://github.com/feelec-yishu/feelcrm-os/](https://github.com/feelec-yishu/feelcrm-os/)
- [https://github.com/feelec-yishu/feelcrm-os/issues/6](https://github.com/feelec-yishu/feelcrm-os/issues/6)

## Related threats

- [FeelCRM-OS unrestricted file upload in UploadTicketFile endpoint](https://junglewise.ai/threats/cve-2026-105389-a-security-vulnerability-has-been-detected-in-feelec-yishu)
- [feelec-yishu feelcrm-os server-side request forgery in getCurlData](https://junglewise.ai/threats/cve-2026-105290-a-vulnerability-was-determined-in-feelec-yishu-feelcrm-os-1-0-0)
- [feelec-yishu FeelCRM OS reflected cross-site scripting in CRM endpoint](https://junglewise.ai/threats/cve-2026-105288-a-vulnerability-has-been-found-in-feelec-yishu-feelcrm-os-1-0-0)
- [feelec-yishu feelcrm-os SQL injection in getMemberByGroups](https://junglewise.ai/threats/cve-2026-105287-a-flaw-has-been-found-in-feelec-yishu-feelcrm-os-1-0-0-affected)