CVE-2025-7879
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to Metasoft MetaCRM systems via the mobileupload.jsp endpoint. Affected are all MetaCRM versions up to 6.4.2, potentially enabling attackers to execute malicious code or compromise the system.
💻 Affected Systems
- Metasoft MetaCRM
📦 What is this software?
Metacrm by Metasoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, data theft, and lateral movement within the network.
Likely Case
Web shell deployment leading to data exfiltration, credential harvesting, and further exploitation of the compromised system.
If Mitigated
Limited impact with proper file upload validation, web application firewalls, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available; vendor has not responded to disclosure. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Block mobileupload.jsp Access
allRestrict access to the vulnerable file via web server configuration or firewall rules.
# Apache: <Location /mobileupload.jsp> Require all denied </Location>
# Nginx: location = /mobileupload.jsp { deny all; }
Implement File Upload Validation
allAdd server-side validation to restrict file types, extensions, and content for uploads.
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) with rules to block malicious file upload attempts.
- Isolate the MetaCRM system in a segmented network zone with strict inbound/outbound controls.
🔍 How to Verify
Check if Vulnerable:
Check if mobileupload.jsp exists and is accessible via HTTP requests; test file upload functionality.Check Version:
Check MetaCRM version in admin panel or configuration files; version <= 6.4.2 indicates vulnerability.Verify Fix Applied:
Verify that mobileupload.jsp is no longer accessible or that file uploads are properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to mobileupload.jsp
- Uploads of suspicious file types (e.g., .jsp, .php, .exe)
- Increased error logs from file validation failures
Network Indicators:
- HTTP traffic to mobileupload.jsp with file uploads
- Outbound connections from MetaCRM to unknown IPs post-exploit
SIEM Query:
source="web_logs" AND uri="/mobileupload.jsp" AND method="POST" AND (file_extension="jsp" OR file_extension="php" OR file_extension="exe")