CVE-2025-41005

Imaster's MEMS Events CRM is affected by an SQL injection vulnerability in the keyword parameter of the /memsdemo/exchange_offers.php endpoint [1]. The lack of proper input sanitization allows an attacker to inject arbitrary SQL queries through this parameter, leading to backend database manipulation.

Exploitation requires low-privileged authentication (CVSS v4.0 PR:L) but no user interaction (UI:N). An authenticated attacker can send specially crafted HTTP requests to the vulnerable parameter, causing the database to execute unintended SQL commands. The attack does not require any user interaction and can be performed remotely over the network (AV:N) [1].

Successful exploitation can result in unauthorized reading, modification, or deletion of database contents. The CVSS v4.0 base score of 8.7 (High) reflects potentially high impact on confidentiality, integrity, and availability of the application [1].

As of the publication date, Imaster has not released a fix for this vulnerability [1]. Organizations using MEMS Events CRM are advised to apply input validation and restrict database permissions as temporary workarounds.