CVE-2025-11912: Streamax Crocus SQL Injection Vulnerability

CVE-2025-11912 Overview

CVE-2025-11912 is a SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus version 1.3.40. The flaw resides in the Query function of the /DeviceState.do?Action=Query endpoint, where the orderField parameter is concatenated into a database query without sanitization. Remote attackers with low-level privileges can manipulate this parameter to execute arbitrary SQL statements against the backend database. The vendor was contacted prior to public disclosure but did not respond. Public exploit details have been published through VulDB. The weakness is categorized under [CWE-89] SQL Injection and [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
Authenticated remote attackers can inject SQL through the orderField parameter to read, modify, or delete data accessible to the Crocus application database user.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus 1.3.40
CPE: cpe:2.3:a:streamax:streamax_crocus:1.3.40:*:*:*:*:*:*:*
Component: streamax:streamax_crocus

Discovery Timeline

2025-10-17 - CVE-2025-11912 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11912

Vulnerability Analysis

The vulnerability exists in the request handler that processes /DeviceState.do?Action=Query requests in the Streamax Crocus application. The Query function accepts an orderField HTTP parameter intended to control the SQL ORDER BY clause when sorting device state records. The application places the supplied value directly into the generated SQL statement without parameterization or allow-list validation.

Attackers submit crafted values in orderField that close the intended SQL fragment and append additional clauses or stacked statements. Because ORDER BY positions typically cannot use bound parameters, developers must enforce strict allow-lists on column names. The Crocus implementation omits this control, exposing the backend database to injection. The publicly referenced technical writeup documents the exact request shape used to trigger the flaw.

Root Cause

The root cause is improper neutralization of special characters in the orderField argument before it is incorporated into a SQL query [CWE-89]. The handler trusts client-controlled input to build database queries dynamically, violating the principle of separating code from data.

Attack Vector

Exploitation requires network access to the Crocus web interface and a low-privileged authenticated session. An attacker issues an HTTP request to /DeviceState.do?Action=Query with a malicious orderField value. The injected SQL executes in the context of the Crocus database account, enabling data extraction, modification, or enumeration of database structure.

The vulnerability mechanism is described in the GitHub Technical Document and the VulDB entry #328922. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2025-11912

Indicators of Compromise

HTTP requests to /DeviceState.do?Action=Query containing SQL metacharacters such as single quotes, comments (--, /*), UNION, SLEEP, or BENCHMARK within the orderField parameter.
Database error messages or unusually long response times correlated with DeviceState.do requests, indicating error-based or time-based injection attempts.
Web access logs showing repeated DeviceState.do?Action=Query requests from a single source with varying orderField values.

Detection Strategies

Deploy web application firewall rules to flag SQL injection patterns in any parameter sent to /DeviceState.do, with particular focus on orderField.
Enable database query logging and alert on syntactically anomalous statements originating from the Crocus application user.
Correlate authentication events with subsequent suspicious queries to identify low-privileged accounts being abused for exploitation.

Monitoring Recommendations

Monitor outbound traffic from the Crocus server for unexpected data exfiltration patterns following requests to DeviceState.do.
Track HTTP 500 responses and database exception traces tied to the Crocus application as early signals of probing.
Review audit logs for unexpected use of database accounts associated with the Crocus service.

How to Mitigate CVE-2025-11912

Immediate Actions Required

Restrict network access to the Crocus management interface so it is reachable only from trusted administrative networks.
Disable or quarantine the /DeviceState.do?Action=Query endpoint until a vendor patch is available, if operationally feasible.
Rotate database credentials used by the Crocus application and limit that account to the minimum required privileges.
Audit existing accounts and remove unused low-privilege users that could be leveraged for authenticated exploitation.

Patch Information

No vendor advisory or patch is currently published. According to the disclosure, Shenzhen Ruiming Technology did not respond to early outreach about this issue. Track the VulDB advisory for updates and contact the vendor directly to request a fix for Streamax Crocus 1.3.40.

Workarounds

Place a web application firewall in front of the Crocus server with signatures blocking SQL injection payloads in the orderField parameter.
Enforce strict input validation at a reverse proxy by rejecting orderField values that do not match an allow-list of expected column names.
Apply database-level least privilege so the Crocus service account cannot execute DDL statements or access unrelated schemas.
Increase logging granularity on the Crocus application server and forward logs to a centralized analytics platform for review.

bash

# Example NGINX reverse proxy rule restricting orderField to safe identifiers
location /DeviceState.do {
    if ($arg_orderField !~* "^[A-Za-z_][A-Za-z0-9_]{0,63}$") {
        return 400;
    }
    proxy_pass http://crocus_backend;
}