CVE-2026-6629 in MetaCRM
Summary
by MITRE • 04/20/2026
A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the file sql.jsp of the component Interface. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/09/2026
This vulnerability in Metasoft MetaCRM version 6.4.0 represents a critical sql injection flaw that compromises the application's database security through its interface component. The vulnerability specifically resides in the Statement.executeUpdate function within the sql.jsp file, where user-supplied input is directly incorporated into sql statements without proper sanitization or parameterization. This design flaw creates an exploitable entry point that allows remote attackers to manipulate database operations through maliciously crafted sql commands. The vulnerability's classification aligns with CWE-89 which identifies sql injection as a fundamental weakness in database interaction code, where untrusted data is embedded into sql queries without adequate validation or escaping mechanisms. The attack vector is particularly concerning as it enables remote exploitation, meaning that malicious actors can leverage this vulnerability from outside the network perimeter without requiring local system access or prior authentication.
The operational impact of this vulnerability extends far beyond simple data theft, as sql injection attacks can enable complete database compromise including data manipulation, unauthorized access to sensitive information, and potential lateral movement within the affected system. Attackers could execute arbitrary sql commands that might allow them to extract confidential customer data, modify business records, or even escalate privileges within the application's database layer. The fact that this vulnerability has been publicly disclosed and is actively being used in the wild significantly increases the risk to organizations utilizing this version of MetaCRM. The lack of vendor response to early disclosure attempts creates a particularly dangerous scenario where organizations face a critical security gap with no official patch or mitigation guidance available from the software vendor, leaving them vulnerable to exploitation while the threat landscape continues to evolve.
Organizations currently running MetaCRM 6.4.0 or earlier versions must implement immediate defensive measures to protect against this vulnerability. The primary mitigation strategy involves implementing proper input validation and parameterized queries throughout the application's sql execution paths, particularly within the affected sql.jsp interface component. Security teams should also deploy web application firewalls with sql injection detection capabilities and conduct thorough network monitoring for suspicious sql query patterns. Additionally, organizations should consider implementing database activity monitoring to detect unauthorized sql operations and establish network segmentation to limit the potential impact of successful exploitation. The vulnerability's alignment with ATT&CK technique T1190 demonstrates how sql injection can be used as a persistence mechanism and data exfiltration vector, making comprehensive defensive measures essential. Organizations should also review their incident response procedures to ensure readiness for potential exploitation attempts and consider implementing automated patch management processes to address similar vulnerabilities in other components of their software ecosystem.