PT-2025-30175 · Metacrm · Metacrm

Nu11 · Published 2025-07-20 · Updated 2025-08-27 · CVE-2025-7873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MetaCRM versions up to 6.4.2

Description A critical issue exists in MetaCRM due to a SQL injection vulnerability within the mcc login.jsp file. The workerid argument can be manipulated to exploit this issue, allowing for remote attacks. The exploit has been publicly disclosed.

Recommendations Versions prior to 6.4.2 should be updated.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-7873

Affected Products

Metacrm

References · 12

• 🔥 https://github.com/FightingLzn9/vul/blob/main/MetaCRM6-SQLI-1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7873 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7873 · Vendor Advisory
• https://twitter.com/CVEnew/status/1946831271147274720 · Twitter Post
• https://vuldb.com/?id.316987 · Note
• https://vuldb.com/?ctiid.316987 · Note
• https://twitter.com/marcin_brz81183/status/1946839213955015110 · Twitter Post
• https://t.me/cvetracker/28249 · Telegram Post
• https://t.me/cveNotify/133734 · Telegram Post
• https://t.me/cvenotify/129586 · Telegram Post
• https://twitter.com/jmdevlabs/status/1952818596251332636 · Twitter Post
• https://vuldb.com/?submit.611043 · Note