CVE-2025-11910: Streamax Crocus SQL Injection Vulnerability

CVE-2025-11910 Overview

CVE-2025-11910 is a SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The flaw exists in the Query function of the /MemoryState.do?Action=Query endpoint. Attackers can manipulate the orderField parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable over the network and requires low-level authentication. The exploit details have been publicly disclosed, increasing risk to exposed deployments. The vendor was contacted prior to public disclosure but did not respond, leaving affected systems without an official patch.

Critical Impact
Authenticated remote attackers can inject SQL through the orderField parameter to read, modify, or extract data from the Crocus backend database.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus 1.3.40
CPE: cpe:2.3:a:streamax:streamax_crocus:1.3.40:*:*:*:*:*:*:*
Affected endpoint: /MemoryState.do?Action=Query

Discovery Timeline

2025-10-17 - CVE-2025-11910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11910

Vulnerability Analysis

The vulnerability is a SQL Injection flaw classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The defect resides in the Query function handling requests to /MemoryState.do?Action=Query. The application accepts the orderField HTTP parameter and concatenates it directly into a SQL ORDER BY clause without parameterization or input validation. Attackers control the resulting SQL syntax, enabling extraction of arbitrary database content or modification of stored data. Public disclosure of the exploit raises the likelihood of opportunistic scanning against internet-facing Crocus deployments.

Root Cause

The root cause is unsafe construction of SQL statements. The orderField argument is interpolated into a query string without prepared statements, allow-list validation, or escaping. Because ORDER BY clauses cannot use bound parameters in most database engines, developers commonly fall back to string concatenation, which leaves the field vulnerable when input is not strictly validated against a known column list.

Attack Vector

Exploitation requires network access to the Crocus web interface and a low-privilege authenticated session. An attacker submits a crafted HTTP request to /MemoryState.do?Action=Query with a malicious orderField value containing SQL syntax such as UNION SELECT, conditional injections, or time-based blind payloads. The injected payload is executed within the database session used by the application, exposing data confidentiality, integrity, and availability at a limited scope.

No verified proof-of-concept code is published in trusted repositories. Refer to the GitHub Vulnerability Report and VulDB entry #328920 for disclosure details.

Detection Methods for CVE-2025-11910

Indicators of Compromise

HTTP requests to /MemoryState.do?Action=Query containing SQL keywords (UNION, SELECT, SLEEP, BENCHMARK, --, /*) in the orderField parameter.
Unusually long orderField values or values containing quote characters, semicolons, or comment markers.
Database error messages or 500 responses generated by the Crocus application when handling MemoryState.do requests.
Spikes in authenticated request volume from a single source against the MemoryState.do endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the orderField parameter for SQL metacharacters and reject non-allow-listed values.
Enable database query logging and alert on queries against MemoryState-related tables that contain syntactically anomalous ORDER BY clauses.
Correlate authenticated session activity with sudden access to /MemoryState.do?Action=Query from atypical source addresses.

Monitoring Recommendations

Forward Crocus web server access logs and database audit logs to a centralized SIEM for long-term retention and pattern analysis.
Baseline normal orderField values used by legitimate clients and alert on deviations.
Monitor for outbound data transfers from the Crocus database host that exceed historical baselines, which may indicate data exfiltration.

How to Mitigate CVE-2025-11910

Immediate Actions Required

Restrict network access to the Crocus management interface using firewall rules or VPN-only access until a vendor fix is available.
Disable or block access to the /MemoryState.do?Action=Query endpoint at a reverse proxy if it is not required for business operations.
Rotate credentials for any low-privilege accounts that could be abused to authenticate and reach the vulnerable endpoint.
Audit Crocus database accounts and enforce least-privilege permissions so that the web application user cannot read or modify sensitive tables.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to coordinated disclosure attempts. Track the VulDB advisory and Shenzhen Ruiming Technology communications for future updates.

Workarounds

Place the Crocus application behind a WAF configured with SQL injection signatures targeting ORDER BY injection patterns.
Implement a reverse proxy rule that validates orderField against an allow list of known column names and rejects all other values.
Reduce the privileges of the database account used by Crocus to read-only where feasible, limiting the impact of injection.
Segment the Crocus server into a restricted network zone to limit lateral movement following a successful exploit.

bash

# Example NGINX reverse-proxy rule to block suspicious orderField values
location /MemoryState.do {
    if ($arg_orderField ~* "('|\"|;|--|/\*|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://crocus_backend;
}