Server-Side Request Forgery in FelCRM Google Controller

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-105290 is a server-side request forgery (SSRF) vulnerability in FelCRM OS 1.0.0's GoogleController that allows remote attackers to manipulate the 'url' parameter in the getCurlData endpoint. By crafting malicious requests, attackers can force the vulnerable server to make arbitrary HTTP requests to internal resources, external systems, or cloud metadata services—potentially exposing sensitive data, accessing internal APIs, or pivoting to backend systems. This vulnerability affects any organization running FelCRM OS 1.0.0 in production environments, particularly those without network segmentation between application and internal infrastructure layers.

Casky's 754 skills mapped to MITRE ATT&CK identify this attack pattern through reconnaissance (TA0001) detection when attackers probe the GoogleController endpoint, and exploitation (TA0006) patterns when malicious URL parameters are submitted. Practitioners using Casky would see findings flagged under CWE-918 for outbound HTTP requests originating from unexpected application components, unusual destination IPs (internal ranges, 169.254.x.x metadata services), or suspicious curl operations targeting non-whitelisted domains. Claude's extended reasoning engine correlates request patterns, parameter manipulation sequences, and response times to distinguish SSRF exploitation attempts from legitimate cross-origin requests, providing security teams with high-confidence indicators for immediate incident response.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105290.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-105290

Casky has 331 skills that investigate the attack patterns behind CVE-2026-105290. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn