CVE-2026-4955: Streamax Crocus SQL Injection Vulnerability

CVE-2026-4955 Overview

A SQL injection vulnerability has been identified in Shenzhen Ruiming Technology Streamax Crocus version 1.3.44. This vulnerability affects an unknown function within the /OperateStatistic.do file, where improper handling of the VehicleID parameter allows attackers to inject malicious SQL commands. The attack can be executed remotely without authentication, and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Critical Impact
Remote attackers can exploit this SQL injection vulnerability to manipulate database queries, potentially leading to unauthorized data access, data modification, or data exfiltration from the affected Streamax Crocus system.

Affected Products

Shenzhen Ruiming Technology Streamax Crocus version 1.3.44

Discovery Timeline

2026-03-27 - CVE CVE-2026-4955 published to NVD
2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4955

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses injection vulnerabilities. The affected component resides within the /OperateStatistic.do endpoint, which appears to handle vehicle statistics operations. The VehicleID parameter is not properly sanitized before being incorporated into SQL queries, allowing attackers to manipulate the query structure.

The network-accessible nature of this vulnerability means that any attacker with network access to the Streamax Crocus system can attempt exploitation without requiring prior authentication or user interaction. Successful exploitation could result in partial compromise of data confidentiality, integrity, and availability within the affected system.

Root Cause

The root cause of this vulnerability stems from inadequate input validation and sanitization of the VehicleID parameter within the /OperateStatistic.do endpoint. User-supplied input is directly concatenated or interpolated into SQL queries without proper parameterization or escaping, creating a classic SQL injection attack surface. This implementation flaw allows malicious SQL syntax to be injected and executed by the underlying database engine.

Attack Vector

The vulnerability is exploitable via network access to the /OperateStatistic.do endpoint. An attacker can craft HTTP requests containing malicious SQL payloads within the VehicleID parameter. Since the vulnerability requires no authentication (as indicated by the privilege requirement in the CVSS vector), any network-adjacent or internet-exposed instance of the Streamax Crocus system is at risk.

Typical attack scenarios include:

Data Extraction: Using UNION-based or blind SQL injection techniques to extract sensitive data from the database
Authentication Bypass: Manipulating queries to bypass authentication checks if the affected endpoint interacts with user credentials
Data Manipulation: Inserting, updating, or deleting records through injected SQL statements

For detailed technical information about this vulnerability, refer to the VulDB entry #353143 or the Feishu Document containing exploit details.

Detection Methods for CVE-2026-4955

Indicators of Compromise

Unusual HTTP requests to /OperateStatistic.do containing SQL syntax characters such as single quotes ('), double dashes (--), semicolons (;), or SQL keywords like UNION, SELECT, DROP, or OR 1=1
Database error messages appearing in application logs or responses that reveal SQL query structure
Unexpected database query patterns or high-volume requests targeting the VehicleID parameter
Anomalous data access patterns in database audit logs, particularly bulk data retrieval operations

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /OperateStatistic.do
Implement database activity monitoring to identify suspicious query patterns, including unexpected UNION operations or time-based delays indicative of blind SQL injection
Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection payloads targeting the VehicleID parameter
Enable detailed logging on the Streamax Crocus application and monitor for error conditions related to malformed SQL queries

Monitoring Recommendations

Monitor all HTTP traffic to the Streamax Crocus application, particularly requests targeting /OperateStatistic.do
Establish baseline metrics for normal database query volume and execution time, alerting on deviations that may indicate exploitation attempts
Review web server and application logs regularly for requests containing encoded or obfuscated SQL injection payloads
Implement network segmentation monitoring to detect any lateral movement following potential database compromise

How to Mitigate CVE-2026-4955

Immediate Actions Required

Restrict network access to the Streamax Crocus system, limiting exposure to trusted networks only
Implement WAF rules to block SQL injection attempts targeting the /OperateStatistic.do endpoint and VehicleID parameter
Enable input validation at the network perimeter to reject requests containing SQL metacharacters
Monitor database and application logs for signs of exploitation attempts or successful attacks
Consider taking the affected system offline if it contains sensitive data and cannot be adequately protected

Patch Information

No official patch information is available at this time. According to the vulnerability disclosure, the vendor (Shenzhen Ruiming Technology) was contacted regarding this issue but did not respond. Users should monitor the VulDB entry and vendor communications for any future patch releases.

Workarounds

Implement network-level access controls to restrict which IP addresses or networks can reach the Streamax Crocus system
Deploy a reverse proxy or WAF in front of the application configured with strict SQL injection detection rules
If possible, disable or restrict access to the /OperateStatistic.do endpoint until a vendor patch is available
Apply database-level permissions to limit the privileges of the application database account, reducing the potential impact of successful SQL injection

bash

# Example: iptables rules to restrict access to Streamax Crocus
# Allow only trusted network (adjust CIDR to match your environment)
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP