SQL Injection in FeelCRM OS via getMemberByGroups

Executive Summary

This is an authenticated SQL injection vulnerability in the feelcrm-os CRM system version 1.0.0. It affects the POST endpoint /Crm/AjaxRequest/getMemberByGroups where user input in the groups[] parameter is directly used in a SQL query without proper sanitization. An attacker can inject malicious SQL payloads to manipulate database queries.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability, monitor HTTP POST requests to the /Crm/AjaxRequest/getMemberByGroups endpoint. Look for unusual groups[] parameter values containing SQL keywords like UNION, SELECT, or database functions. Test with payloads such as groups[]=1 UNION SELECT 1,2,3-- to observe database responses. Check application logs for malformed SQL errors or unexpected JSON outputs indicating successful exploitation.

• Use tools like sqlmap to automate detection: sqlmap -u 'http://target.com/Crm/AjaxRequest/getMemberByGroups' --data='groups[]=1' --batch --risk=3 --level=5

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker could exploit this to extract sensitive data from the database, such as customer information or credentials. They might also modify or delete data, leading to data corruption or loss. The impact depends on the database privileges and the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the AjaxRequestController.class.php file to use parameterized queries instead of raw SQL string concatenation. Validate the groups[] input against a whitelist of allowed department IDs. Disable the vulnerable endpoint if possible or restrict access to authenticated users with minimal privileges. Monitor database logs for suspicious queries or unauthorized data access attempts.

• Apply input sanitization by replacing htmlspecialchars() with proper escaping functions like mysqli_real_escape_string() or use prepared statements with PDO.

Useful 0 Not Useful 0