CVE-2026-4955: Streamax Crocus SQL Injection Vulnerability

CVE-2026-4955 Overview

A SQL injection vulnerability has been identified in Shenzhen Ruiming Technology Streamax Crocus version 1.3.44. This vulnerability affects an unknown function within the /OperateStatistic.do file, where improper handling of the VehicleID parameter allows attackers to inject malicious SQL commands. The attack can be executed remotely without authentication, and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to manipulate database queries, potentially leading to unauthorized data access, data modification, or data exfiltration from the affected Streamax Crocus system.

Affected Products

• Shenzhen Ruiming Technology Streamax Crocus version 1.3.44

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-4955 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4955

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses injection vulnerabilities. The affected component resides within the /OperateStatistic.do endpoint, which appears to handle vehicle statistics operations. The VehicleID parameter is not properly sanitized before being incorporated into SQL queries, allowing attackers to manipulate the query structure.

The network-accessible nature of this vulnerability means that any attacker with network access to the Streamax Crocus system can attempt exploitation without requiring prior authentication or user interaction. Successful exploitation could result in partial compromise of data confidentiality, integrity, and availability within the affected system.

Root Cause

The root cause of this vulnerability stems from inadequate input validation and sanitization of the VehicleID parameter within the /OperateStatistic.do endpoint. User-supplied input is directly concatenated or interpolated into SQL queries without proper parameterization or escaping, creating a classic SQL injection attack surface. This implementation flaw allows malicious SQL syntax to be injected and executed by the underlying database engine.

Attack Vector

The vulnerability is exploitable via network access to the /OperateStatistic.do endpoint. An attacker can craft HTTP requests containing malicious SQL payloads within the VehicleID parameter. Since the vulnerability requires no authentication (as indicated by the privilege requirement in the CVSS vector), any network-adjacent or internet-exposed instance of the Streamax Crocus system is at risk.

Typical attack scenarios include:

1. Data Extraction: Using UNION-based or blind SQL injection techniques to extract sensitive data from the database
2. Authentication Bypass: Manipulating queries to bypass authentication checks if the affected endpoint interacts with user credentials
3. Data Manipulation: Inserting, updating, or deleting records through injected SQL statements

For detailed technical information about this vulnerability, refer to the VulDB entry #353143 or the Feishu Document containing exploit details.

Detection Methods for CVE-2026-4955

Indicators of Compromise

• Unusual HTTP requests to /OperateStatistic.do containing SQL syntax characters such as single quotes ('), double dashes (--), semicolons (;), or SQL keywords like UNION, SELECT, DROP, or OR 1=1
• Database error messages appearing in application logs or responses that reveal SQL query structure
• Unexpected database query patterns or high-volume requests targeting the VehicleID parameter
• Anomalous data access patterns in database audit logs, particularly bulk data retrieval operations

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /OperateStatistic.do
• Implement database activity monitoring to identify suspicious query patterns, including unexpected UNION operations or time-based delays indicative of blind SQL injection
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection payloads targeting the VehicleID parameter
• Enable detailed logging on the Streamax Crocus application and monitor for error conditions related to malformed SQL queries

Monitoring Recommendations

• Monitor all HTTP traffic to the Streamax Crocus application, particularly requests targeting /OperateStatistic.do
• Establish baseline metrics for normal database query volume and execution time, alerting on deviations that may indicate exploitation attempts
• Review web server and application logs regularly for requests containing encoded or obfuscated SQL injection payloads
• Implement network segmentation monitoring to detect any lateral movement following potential database compromise

How to Mitigate CVE-2026-4955

Immediate Actions Required

• Restrict network access to the Streamax Crocus system, limiting exposure to trusted networks only
• Implement WAF rules to block SQL injection attempts targeting the /OperateStatistic.do endpoint and VehicleID parameter
• Enable input validation at the network perimeter to reject requests containing SQL metacharacters
• Monitor database and application logs for signs of exploitation attempts or successful attacks
• Consider taking the affected system offline if it contains sensitive data and cannot be adequately protected

Patch Information

No official patch information is available at this time. According to the vulnerability disclosure, the vendor (Shenzhen Ruiming Technology) was contacted regarding this issue but did not respond. Users should monitor the VulDB entry and vendor communications for any future patch releases.

Workarounds

• Implement network-level access controls to restrict which IP addresses or networks can reach the Streamax Crocus system
• Deploy a reverse proxy or WAF in front of the application configured with strict SQL injection detection rules
• If possible, disable or restrict access to the /OperateStatistic.do endpoint until a vendor patch is available
• Apply database-level permissions to limit the privileges of the application database account, reducing the potential impact of successful SQL injection

# Example: iptables rules to restrict access to Streamax Crocus
# Allow only trusted network (adjust CIDR to match your environment)
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP