A SQL injection flaw exists in the RPCService.query method of Metasoft 美特软件 MetaCRM, which interprets the external phprpc_args parameter as raw SQL and passes it directly to the database. The vulnerability is classified as CWE‑89 and CWE‑74 and can allow an attacker to execute arbitrary SQL statements, including SELECT, UPDATE, and DELETE, against the application database. If exploited, attackers could read, modify or delete sensitive business data stored in the MetaCRM system.

All installations of Metasoft 美特软件 MetaCRM up to and including version 6.4.0 Beta06 that include the PHPRPC Remote Call Interface component located under /customizemt/xkq/rpc.jsp are impacted. No newer releases or patches are listed as affected, and earlier versions appear not to implement the vulnerable method.

The vulnerability is assigned a CVSS score of 6.9, indicating moderate severity. The very low EPSS score (< 1%) implies a small probability of exploitation, yet the vulnerability is not listed in CISA KEV. The flaw is remotely exploitable over HTTP: attackers can craft malicious phprpc_args values in requests to the exposed rpc.jsp endpoint, and public exploits have already been released. Therefore the risk is tangible primarily for systems that expose the endpoint to untrusted networks.