CVE-2026-52469: Crocus v1.3.44 SQL Injection Vulnerability

CVE-2026-52469 Overview

CVE-2026-52469 is a SQL injection vulnerability affecting Crocus version 1.3.44. The flaw resides in the DeviceInfoMapper.xml file and allows a remote, unauthenticated attacker to inject arbitrary SQL statements. Successful exploitation enables privilege escalation and full compromise of the underlying database.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Attackers can reach the vulnerable endpoint over the network without user interaction, making the issue trivially exploitable when the affected component is exposed.

Critical Impact
Remote attackers can escalate privileges and obtain full read, write, and administrative control over the Crocus database without authentication.

Affected Products

Crocus version 1.3.44
Deployments exposing the DeviceInfoMapper.xml query mapping component
Applications using the affected MyBatis mapper without input sanitization

Discovery Timeline

2026-07-21 - CVE-2026-52469 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-52469

Vulnerability Analysis

The vulnerability originates in the DeviceInfoMapper.xml file, which defines SQL query templates used by the Crocus application. The mapper concatenates user-supplied input directly into SQL statements instead of using parameterized queries. This behavior is a canonical MyBatis anti-pattern, typically caused by the use of ${parameter} string substitution rather than #{parameter} prepared statement binding.

An unauthenticated remote attacker can supply crafted input to any endpoint that invokes the affected mapper. The injected SQL executes with the privileges of the application's database user. Because Crocus is a device management platform, that user commonly holds broad rights across configuration and identity tables, enabling privilege escalation within the application.

The EPSS score is 0.383%, reflecting current exploitation probability, while a public proof of concept is available on GitHub.

Root Cause

The root cause is improper neutralization of special elements in SQL commands within the DeviceInfoMapper.xml mapper definitions. User input flows into SQL statements without validation, escaping, or parameter binding. Any request parameter consumed by the vulnerable mapper becomes an injection sink.

Attack Vector

Exploitation requires only network access to the Crocus application. No credentials or user interaction are needed. An attacker submits crafted HTTP requests containing SQL metacharacters or UNION-based payloads targeting endpoints backed by DeviceInfoMapper.xml. Successful injection enables data exfiltration, authentication token theft, insertion of administrative accounts, and privilege escalation within the application.

A public proof of concept is available at the GitHub SQL Injection PoC repository, which documents the specific request payload used to trigger the flaw.

Detection Methods for CVE-2026-52469

Indicators of Compromise

HTTP requests to Crocus endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in query parameters or body fields
Unexpected database errors or verbose SQL exceptions logged by the Crocus application
New or modified administrative accounts in the Crocus user table without corresponding audit trail entries
Anomalous outbound data transfers from the Crocus database host

Detection Strategies

Deploy web application firewall rules that inspect requests to Crocus endpoints for SQL injection signatures targeting device information APIs
Enable database query logging and alert on statements originating from the Crocus application user that reference information_schema, mysql.user, or unusual UNION operations
Baseline normal request patterns to DeviceInfoMapper endpoints and alert on structural deviations

Monitoring Recommendations

Forward application and database logs to a centralized analytics platform for correlation of injection attempts with downstream database activity
Monitor authentication and authorization tables for unauthorized privilege changes
Track failed login events immediately preceded by anomalous requests to the affected endpoints

How to Mitigate CVE-2026-52469

Immediate Actions Required

Restrict network access to the Crocus application to trusted management networks until a patch is applied
Deploy web application firewall rules blocking SQL injection payloads targeting Crocus endpoints
Rotate database credentials and audit the Crocus database user for excessive privileges
Review Crocus user and role tables for unauthorized accounts or privilege escalations

Patch Information

No vendor advisory or fixed version has been published in the referenced sources at the time of this writing. Administrators should monitor the Crocus vendor channels for an updated release addressing DeviceInfoMapper.xml. Until then, apply the workarounds below and confirm remediation by reviewing mapper definitions for parameterized query usage.

Workarounds

Modify DeviceInfoMapper.xml to replace ${parameter} string substitutions with #{parameter} prepared statement bindings
Apply strict server-side input validation and allow-listing on all parameters consumed by the affected mapper
Enforce least-privilege on the database account used by Crocus, removing DROP, CREATE USER, and cross-schema access rights
Place the application behind an authenticated reverse proxy to eliminate unauthenticated network exposure

bash

# Example WAF rule (ModSecurity) blocking common SQL injection payloads to Crocus endpoints
SecRule REQUEST_URI "@contains /device" \
  "phase:2,deny,status:403,id:1052469,\
   msg:'CVE-2026-52469 SQLi attempt against Crocus DeviceInfoMapper',\
   chain"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--\s|;\s*drop\s)" "t:none,t:urlDecodeUni"