| शीर्षक | Beijing Meite Software Technology Co., Ltd. MetaCRM6 <6.4.0 SQL Injection |
|---|
| विवरण | A critical vulnerability exists in the sql.jsp endpoint of software developed by Beijing Meite Software Technology Co., Ltd. The interface fails to implement any authentication mechanisms and directly invokes the Statement.executeUpdate() method. This allows a remote, unauthenticated attacker to inject and execute arbitrary DML (e.g., UPDATE, DELETE, INSERT) and DDL statements via the sql parameter.
Despite the technical limitation of executeUpdate, an attacker can compromise the system by tampering with administrative credentials, modifying mission-critical business data, or performing a permanent Denial of Service (DoS) by clearing database tables via DELETE or TRUNCATE commands, leading to a total loss of data integrity and availability. |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/docx/JttndUaPLoR88HxI1alcz1uencf?from=from_copylink |
|---|
| उपयोगकर्ता | 0menc (UID 75423) |
|---|
| सबमिशन | 30/03/2026 03:49 AM (6 महीनों पहले) |
|---|
| संयम | 19/04/2026 06:49 PM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 358263 [Metasoft 美特软件 MetaCRM तक 6.4.0 Interface sql.jsp Statement.executeUpdate sql SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|