CVE-2025-11909
📋 TL;DR
This CVE describes a SQL injection vulnerability in Shenzhen Ruiming Technology's Streamax Crocus system version 1.3.40. Attackers can manipulate the 'orderField' parameter in the /RepairRecord.do?Action=QueryLast endpoint to execute arbitrary SQL commands. Organizations using this specific version of the Streamax Crocus system are affected.
💻 Affected Systems
- Shenzhen Ruiming Technology Streamax Crocus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Shenzhen Ruiming Technology for updated version information.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the orderField parameter to only allow expected values
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the system from internet access and restrict network access to trusted IPs only
- Implement database monitoring and alerting for suspicious SQL queries
🔍 How to Verify
Check if Vulnerable:
Check if system is running Streamax Crocus version 1.3.40 and test the /RepairRecord.do?Action=QueryLast endpoint with SQL injection payloads in the orderField parameterCheck Version:
Check system documentation or web interface for version informationVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- Requests to /RepairRecord.do with suspicious orderField parameters
Network Indicators:
- HTTP requests containing SQL keywords in orderField parameter
- Unusual database traffic patterns
SIEM Query:
web.url:*RepairRecord.do* AND (web.param.orderField:*SELECT* OR web.param.orderField:*UNION* OR web.param.orderField:*OR*)🔗 References
- https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-2.md
- https://vuldb.com/?ctiid.328919
- https://vuldb.com/?id.328919
- https://vuldb.com/?submit.671412
- https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-2.md
