Metasoft MetaCRM SQL Injection Vulnerability in Interface Component

A critical SQL injection vulnerability has been identified in Metasoft MetaCRM versions prior to 6.4.0. The issue resides in the Interface component, specifically within the sql.jsp file, where the Statement.executeUpdate method is called without proper authentication. This flaw allows remote, unauthenticated attackers to inject and execute arbitrary SQL commands, including data manipulation and definition language statements. Exploitation could lead to unauthorized changes in administrative credentials, disruption of essential business data, or a permanent denial-of-service by deleting or truncating database tables, causing a complete loss of data integrity and availability.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, with potential impacts including unauthorized data manipulation, disruption of critical business operations, and permanent loss of data integrity and availability.

Reproduction

The vulnerability can be reproduced by sending a request to the sql.jsp endpoint with a crafted sql parameter that exploits the lack of input validation. This can be done remotely without any authentication.