A critical SQL injection vulnerability in dameng100 muucmf allows unauthenticated remote attackers to compromise database integrity and potentially achieve remote code execution.

The application fails to properly sanitize user input in the keyword parameter within the /index/Search/index.html endpoint, which is processed by the vulnerable getListByPage function. This allows an unauthenticated attacker to inject malicious SQL queries that execute with the privileges of the database user.

Successful exploitation permits unauthorized access to sensitive database information, including user credentials and configuration details. Depending on the database configuration, attackers may escalate this access to perform remote code execution on the underlying host. While the provided CVSS score is 7.3, the potential for full system compromise and the presence of public exploit material justify treating this as a high-urgency threat.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the affected /index/Search/index.html endpoint at the network or web server level.

Proactive Monitoring: Review web server access logs for anomalous requests to the search endpoint, specifically looking for SQL syntax patterns such as SLEEP, UNION, or comment characters like /**/.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the keyword parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's technical write-up.

Given the availability of public proof-of-concept code and the lack of a vendor-provided patch, this vulnerability poses a significant risk to the confidentiality and integrity of the system. Organizations currently running muucmf 1.9.5.20260309 must prioritize implementing compensatory controls, such as WAF filtering, to mitigate the risk of unauthenticated remote exploitation until an official update is released.