This vulnerability in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06 involves SQL injection via the RPCService.query function in the /customizemt/xkq/rpc.jsp file, part of the PHPRPC Remote Call Interface. By manipulating the phprpc_args argument, an attacker can perform SQL injection remotely. The vendor has not provided any response or patch. The CVSS 4.0 score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required, but with limited confidentiality, integrity, and availability impact.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation within the MetaCRM database. The impact is rated medium severity, reflecting limited but significant risk to confidentiality, integrity, and availability. No known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is provided, consider restricting access to the affected RPCService.query interface or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the phprpc_args parameter.