Attack Chain

1. An attacker identifies a vulnerable Metasoft MetaCRM instance exposed to the internet.
2. The attacker crafts a specially malformed phprpc_args parameter containing SQL injection payload.
3. The attacker sends an HTTP POST request to the /customizemt/xkq/rpc.jsp endpoint on the vulnerable server, including the malicious phprpc_args parameter.
4. The server's RPCService.query function within the PHPRPC Remote Call Interface processes the request without proper sanitization.
5. The injected SQL commands are executed by the backend database, leading to unauthorized data access or manipulation.
6. The attacker gains access to sensitive database information, potentially leading to data exfiltration or further system compromise.

Impact

Successful exploitation of CVE-2026-15514 can result in significant data compromise. Attackers can gain unauthorized read and write access to the MetaCRM database, potentially exfiltrating sensitive customer information, financial data, or internal business records. Manipulation of database content could lead to data integrity issues, service disruption, or even administrative account compromise if credentials are stored insecurely. The widespread use of MetaCRM in various sectors means that a successful attack could impact numerous organizations, resulting in financial losses, reputational damage, and regulatory penalties. The public availability of an exploit significantly escalates the threat level, making immediate action crucial for all affected organizations.

Recommendation

• Deploy the Sigma rule provided in this brief to your SIEM to detect exploitation attempts against CVE-2026-15514.
• Monitor web server logs (category: webserver) for suspicious POST requests to /customizemt/xkq/rpc.jsp containing SQL injection patterns in the query string.
• Apply any available patches or updates from Metasoft 美特软件 addressing CVE-2026-15514 as soon as they are released. In the absence of an official patch, consider implementing a Web Application Firewall (WAF) to filter malicious input to the /customizemt/xkq/rpc.jsp endpoint.