MetaCRM SQL Injection via PHPRPC Remote Call Interface

Executive Summary

This vulnerability exists in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06, specifically in the RPCService.query function within the /customizemt/xkq/rpc.jsp file of the PHPRPC Remote Call Interface component.

An attacker can manipulate the argument phprpc_args to perform an SQL injection attack. This means that malicious SQL code can be injected and executed on the database through this vulnerable function.

The attack can be launched remotely, and an exploit for this vulnerability has already been made publicly available.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking for the presence of the vulnerable component in Metasoft MetaCRM up to version 6.4.0 Beta06. The vulnerability is located in the /customizemt/xkq/rpc.jsp file, specifically in the RPCService.query function, where the phprpc_args argument can be manipulated to perform SQL injection.

• Inspect network traffic for requests to /customizemt/xkq/rpc.jsp. Look for unusual or malformed phprpc_args parameters that may indicate exploitation attempts.
• Use a web application vulnerability scanner (e.g., OWASP ZAP, Burp Suite) to scan for SQL injection vulnerabilities in the MetaCRM application, targeting the /customizemt/xkq/rpc.jsp endpoint.
• Check server logs for suspicious activity related to the /customizemt/xkq/rpc.jsp file, such as repeated failed requests or unusual parameter values.
• Verify the installed version of MetaCRM. If it is version 6.4.0 Beta06 or earlier, the system is likely vulnerable.

Example commands or tools to assist in detection:

• Use curl to test for SQL injection by sending a crafted request: curl "http://[target]/customizemt/xkq/rpc.jsp" -d "phprpc_args=[malicious_payload]"
• Use a network monitoring tool (e.g., Wireshark, tcpdump) to capture and analyze traffic to the vulnerable endpoint: tcpdump -i eth0 -s 0 -A 'port 80 and host [target]' | grep -i "phprpc_args"

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute unauthorized SQL commands on the affected system's database remotely.

Potential impacts include unauthorized access to sensitive data, data modification, data deletion, or disruption of service.

Since the exploit is publicly available, the risk of exploitation is higher, especially if the system is exposed to the internet and not patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a SQL injection in the MetaCRM software that can be exploited remotely, potentially leading to unauthorized access or manipulation of data.

Such unauthorized access or data manipulation could impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against breaches.

However, specific effects on compliance or mitigation measures are not detailed in the provided information.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Apply the latest patch or update from Metasoft if available. Since the vendor did not respond, check for third-party patches or community fixes.
• If updating is not immediately possible, restrict access to the /customizemt/xkq/rpc.jsp endpoint by configuring firewall rules or web server access controls to block external access.
• Implement a web application firewall (WAF) to filter and block SQL injection attempts targeting the vulnerable endpoint.
• Monitor the application logs for signs of exploitation attempts and respond to any suspicious activity.
• Consider disabling the RPCService.query function if it is not critical to business operations, or replace it with a secure alternative.
• Review and sanitize all user inputs, especially those passed to the phprpc_args parameter, to prevent SQL injection attacks.

Useful 0 Not Useful 0