| शीर्षक | 美特软件 MetaCRM 6.4.2 SQL Injection |
|---|
| विवरण | MetaCRM6 is an enterprise-level customer relationship management system developed by Beijing Metasoft Technology Co., Ltd. Launched in December 2009, it targets medium and large enterprises, offering intelligent, platform-based CRM solutions. Key features include 360° customer profile management, full sales cycle support, multi-organization management, efficient delivery processes, and integration with ERP/PLM/MES. It serves over 40 sectors like smart manufacturing and medical equipment, with a mobile app for iPad.
However，The mcc_login.jsp interface in MetaCRM6 is vulnerable to SQL injection
A SQL injection sink point has been identified through global search, specifically at a parameter concatenation location.
Upon examining the "getArray "method in the "com.metasoft.framework.db.DBManager" class, it was found that parameters are directly concatenated into the SQL statement without any filtering or sanitization before execution.
This oversight leads to a SQL injection vulnerability exploitable via the front end.
|
|---|
| स्रोत | ⚠️ https://github.com/FightingLzn9/vul/blob/main/MetaCRM6-SQLI-1.md |
|---|
| उपयोगकर्ता | nu11 (UID 81380) |
|---|
| सबमिशन | 08/07/2025 05:11 AM (1 वर्ष पहले) |
|---|
| संयम | 19/07/2025 09:15 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 316987 [Metasoft 美特软件 MetaCRM तक 6.4.2 mcc_login.jsp workerid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|