Loading vulnerability…
SQL injection in Imaster MEMS Events CRM /memsdemo/login.php (phone parameter)
Imaster’s MEMS Events CRM is vulnerable to SQL injection via the ‘phone’ parameter handled by the ‘/memsdemo/login.php’ endpoint. The application improperly neutralizes special elements used in SQL commands (CWE-89), allowing attacker-controlled input in the ‘phone’ field to be incorporated into backend database queries, enabling execution of unintended SQL statements.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can allow SQL injection against the backend database, potentially resulting in unauthorized read/write access to data, data exfiltration, and modification of records. Depending on the query context in the login flow, exploitation may also enable authentication bypass. The published CVSS v4.0 base score is 9.3 (Critical) with AV:N/AC:L/AT:N/PR:N/UI:N and high impacts to confidentiality, integrity, and availability (VC:H/VI:H/VA:H).
If you can’t patch tonight, do this now.
Until a vendor fix is available, enforce strict server-side validation for the ‘phone’ parameter (allowlist expected phone formats), and ensure all database access uses prepared statements. Deploy WAF rules to detect/block SQLi payloads targeting ‘/memsdemo/login.php’ (e.g., SQL metacharacters/keywords in ‘phone’). If feasible, restrict access to the affected endpoint (IP allowlisting/VPN) and increase monitoring/logging for SQLi attempts.
Patch, then assume compromise.
Apply a vendor-provided fixed release when available. Refactor ‘/memsdemo/login.php’ to use parameterized queries/prepared statements (eliminate string concatenation for SQL construction), and validate/filter inputs sent to the database. Ensure the web application’s database account uses least-privilege permissions to reduce blast radius if injection occurs.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.