CVE-2025-11909: Streamax Crocus SQLi Vulnerability

CVE-2025-11909 Overview

CVE-2025-11909 is a SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The flaw resides in the queryLast function within the /RepairRecord.do?Action=QueryLast endpoint. Attackers can manipulate the orderField argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely and requires only low-level authentication. Public exploit details have been released, and the vendor did not respond to disclosure attempts. The issue is tracked under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject SQL through the orderField parameter to read or alter database records in unpatched Streamax Crocus deployments.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus 1.3.40
Component: queryLast function in /RepairRecord.do
CPE: cpe:2.3:a:streamax:streamax_crocus:1.3.40

Discovery Timeline

2025-10-17 - CVE-2025-11909 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11909

Vulnerability Analysis

The vulnerability stems from unsanitized user input passed to the queryLast function in the Streamax Crocus web application. When a client submits a request to /RepairRecord.do?Action=QueryLast, the application incorporates the orderField parameter directly into a backend SQL query. Because the parameter is not validated, escaped, or bound through a parameterized query, an attacker can append arbitrary SQL syntax to alter query logic.

Exploitation requires network access to the application and a low-privilege authenticated session. No user interaction is needed. Successful injection can disclose database contents, alter records, or chain into further attacks on the underlying data layer. Public proof-of-concept material has been referenced in the GitHub Vulnerability Document and indexed in VulDB entry #328919.

Root Cause

The root cause is improper neutralization of SQL syntax in the orderField request parameter. The queryLast function builds the ORDER BY clause through string concatenation rather than allow-listing column names or using bind parameters. ORDER BY positions are particularly susceptible because most database drivers do not accept bound parameters for column identifiers, requiring strict server-side validation that is absent here.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /RepairRecord.do?Action=QueryLast with a malicious orderField value. The injected fragment is executed against the backend database in the context of the application's database user. Because the endpoint is reachable over the network, exposure depends on whether the Crocus management interface is internet-facing or restricted to an internal network segment.

No verified exploit code is referenced for this article. See the linked VulDB submission #671412 for additional technical detail.

Detection Methods for CVE-2025-11909

Indicators of Compromise

HTTP requests to /RepairRecord.do?Action=QueryLast containing SQL keywords such as UNION, SELECT, SLEEP, or -- inside the orderField parameter.
Web server access logs showing unusually long orderField values or URL-encoded payloads from a single source.
Database error messages or unexpected query latency correlated with requests to the affected endpoint.

Detection Strategies

Deploy a web application firewall rule that inspects the orderField query parameter and blocks SQL metacharacters and tautology patterns.
Enable verbose application and database query logging on the Crocus host to capture the full SQL statements executed during queryLast calls.
Correlate authentication events with subsequent requests to /RepairRecord.do to identify low-privilege accounts probing the endpoint.

Monitoring Recommendations

Alert on any non-allow-listed value supplied for orderField, since legitimate clients should submit a small fixed set of column names.
Monitor database accounts used by Crocus for sudden spikes in row reads, schema enumeration queries against information_schema, or use of time-based functions.
Track outbound connections from the Crocus application server to detect data exfiltration that may follow successful injection.

How to Mitigate CVE-2025-11909

Immediate Actions Required

Restrict network access to the Crocus management interface so it is reachable only from trusted administrative networks or via VPN.
Audit accounts that can authenticate to Crocus and disable or rotate credentials for any account that does not require access.
Deploy WAF signatures that block SQL injection patterns targeting the orderField parameter on /RepairRecord.do.

Patch Information

No vendor patch is currently referenced in the advisory data. The vendor was contacted prior to disclosure and did not respond. Monitor the VulDB CTI entry #328919 and the vendor's communications channels for any future fix announcement. Until an official update is released, treat all Streamax Crocus 1.3.40 installations as vulnerable.

Workarounds

Place the application behind a reverse proxy that enforces an allow-list of acceptable orderField values such as known column names.
Apply least-privilege controls to the database account used by Crocus, removing rights to access unrelated schemas or system tables.
If the affected functionality is not required, restrict access to /RepairRecord.do?Action=QueryLast at the proxy or load balancer until a fix is available.

bash

# Example NGINX snippet to block SQL metacharacters in orderField
location /RepairRecord.do {
    if ($arg_orderField ~* "('|\"|;|--|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://crocus_backend;
}