A critical SQL injection vulnerability in Metasoft MetaCRM exposes the application to remote, unauthenticated database manipulation and potential data compromise.

The application is susceptible to SQL injection within the Statement.executeUpdate function in the sql.jsp file of the Interface component. This vulnerability is remotely exploitable by an unauthenticated attacker who can inject malicious SQL commands through the sql argument.

Successful exploitation allows an unauthorized attacker to interact directly with the backend database. This may lead to the exfiltration of sensitive CRM data, modification of records, or potential disruption of service. Given the CVSS score of 7.3, this high-severity flaw represents a significant risk to data confidentiality and integrity, particularly for organizations storing customer information within the MetaCRM platform.

Immediate Action: Since the vendor has not responded to disclosure and no official patch is currently available, administrators should restrict access to the affected sql.jsp endpoint at the network or web server level.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based queries or unexpected character patterns, that suggest SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious input directed at the sql.jsp endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

The absence of a vendor-provided patch necessitates immediate defensive action to isolate the vulnerable component. Organizations using MetaCRM 6.4.0 and earlier must prioritize blocking access to the vulnerable interface to prevent unauthorized database access. Continuous vigilance and the implementation of robust WAF rules are essential until the manufacturer provides an official security update.