Loading vulnerability…
SQL injection in Imaster MEMS Events CRM /memsdemo/exchange_offers.php (keyword parameter)
Imaster’s MEMS Events CRM is vulnerable to SQL injection via improper neutralization of user-controlled input in the keyword parameter handled by the /memsdemo/exchange_offers.php endpoint. An attacker can supply crafted SQL metacharacters/expressions in keyword that are incorporated into backend SQL queries without adequate parameterization/escaping, enabling execution of unintended SQL statements (including potentially blind SQLi depending on response behavior).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow unauthorized interaction with the underlying database, including reading sensitive data, modifying or deleting records, and potentially bypassing authentication/authorization checks depending on how the injected query is used and the database account privileges. Given the CVSS v4.0 base score (8.7) and network attack vector, the issue is high severity and remotely exploitable.
If you can’t patch tonight, do this now.
Until a fixed version is available, restrict access to /memsdemo/exchange_offers.php (e.g., VPN/IP allowlisting), deploy/enable WAF rules to detect and block SQLi payloads targeting the keyword parameter, and ensure the application’s database account is least-privileged to limit data exposure and prevent destructive actions.
Patch, then assume compromise.
Implement parameterized queries/prepared statements for all database interactions involving the keyword parameter in /memsdemo/exchange_offers.php, and add strict server-side input validation (type/length/allowlist) appropriate to the expected search semantics. Review and refactor any dynamic SQL construction in the affected code path. Apply a vendor-provided patch/update when available; the referenced advisory indicates no official patch was available at the time of publication.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.