EUVD-2026-43255
GHSA-3gpm-jrp3-j6m4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint requires no interaction; impact capped at Low C/I/A consistent with SQL injection without confirmed privilege escalation or scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipulation of the argument phprpc_args can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Metasoft (美特软件) MetaCRM up to version 6.4.0 Beta06 enables unauthenticated remote attackers to manipulate the phprpc_args parameter passed to the RPCService.query function at the PHPRPC Remote Call Interface endpoint /customizemt/xkq/rpc.jsp, potentially reading, altering, or deleting database contents. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction from any network-reachable position. Publicly available exploit code exists (confirmed by E:P in the CVSS 4.0 supplemental metrics), though this CVE is not currently listed in CISA KEV; the vendor did not respond to disclosure, leaving no official patch available.
Technical ContextAI
The affected component is a PHPRPC (PHP Remote Procedure Call) bridge endpoint implemented in a JSP file at /customizemt/xkq/rpc.jsp within the MetaCRM application. PHPRPC is a cross-language binary serialization RPC protocol originally from PHP, and its presence inside a Java/JSP stack indicates a mixed-technology bridge that may complicate consistent input validation. The RPCService.query function accepts the phprpc_args argument and incorporates it into a SQL query without adequate sanitization or parameterized query usage. CWE-74 (Injection) is the assigned root cause class, which covers the broader family of interpretation failures where user-controlled data is processed as executable code or commands - in this case, SQL. The practical sub-type is SQL injection (CWE-89). No CPE string was supplied in the source data; the affected product is identified solely by vendor name and version ceiling (Metasoft MetaCRM ≤ 6.4.0 Beta06). The use of a Beta version string in the ceiling suggests the software may be in active development, making patch timing and version tracking uncertain.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor (Metasoft) did not respond to coordinated disclosure, and no fix version exists to cite. As the highest-priority compensating control, restrict network access to /customizemt/xkq/rpc.jsp via WAF rule or network ACL; this eliminates remote exploitation for external attackers but does not address insider or lateral-movement scenarios. Deploy a WAF signature to detect and block SQL injection patterns specifically targeting the phprpc_args parameter in POST/GET bodies directed at this endpoint. If MetaCRM is internet-exposed, immediately place it behind a VPN or restrict access to trusted organizational IP ranges - this alone eliminates the AV:N attack surface. Harden the database account used by MetaCRM to the minimum necessary privileges (read-only where applicable) to limit the blast radius of any successful injection; note this does not prevent exploitation but caps data exposure. Monitor VulDB (https://vuldb.com/vuln/377843) and the vendor's channels for any future patch release. If no remediation path becomes available, consider replacing or retiring the product if it handles sensitive customer data.
Share
External POC / Exploit Code
Leaving vuln.today