CVE-2025-7873
📋 TL;DR
This critical SQL injection vulnerability in Metasoft MetaCRM allows attackers to execute arbitrary SQL commands by manipulating the workerid parameter in the mcc_login.jsp file. Remote attackers can potentially access, modify, or delete database contents. All users of MetaCRM up to version 6.4.2 are affected.
💻 Affected Systems
- Metasoft MetaCRM
📦 What is this software?
Metacrm by Metasoft
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of sensitive customer data, authentication bypass, privilege escalation, and potential remote code execution.
Likely Case
Unauthorized data access, credential theft, and potential lateral movement within the database.
If Mitigated
Limited impact with proper input validation, WAF protection, and database permission restrictions.
🎯 Exploit Status
Public exploit code available on GitHub. SQL injection via workerid parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider upgrading to version 6.4.3 or later if available, or implement workarounds.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the workerid parameter
# Example ModSecurity rule: SecRule ARGS:workerid "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
allAdd server-side validation to sanitize workerid parameter before processing
# Example Java filter: String workerid = request.getParameter("workerid").replaceAll("[^a-zA-Z0-9]", "");
🧯 If You Can't Patch
- Block external access to mcc_login.jsp using network ACLs or firewall rules
- Implement database user privilege reduction to limit potential damage from SQL injection
🔍 How to Verify
Check if Vulnerable:
Test mcc_login.jsp with SQL injection payloads in workerid parameter: mcc_login.jsp?workerid=1' OR '1'='1Check Version:
Check MetaCRM version in admin panel or application metadata filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error responses📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL patterns in parameters
- Requests to mcc_login.jsp with unusual parameter values
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT) in workerid parameter
- Abnormal database query patterns from application server
SIEM Query:
source="web_logs" AND uri="*mcc_login.jsp*" AND (param="*workerid*" AND value="*' OR*" OR value="*UNION*" OR value="*SELECT*" OR value="*--*" OR value="*;*" OR value="*/*")