CVE-2025-11911
📋 TL;DR
This SQL injection vulnerability in Shenzhen Ruiming Technology's Streamax Crocus system allows attackers to manipulate database queries through the sortField parameter. Attackers can potentially read, modify, or delete database contents, and in some cases execute arbitrary commands. Organizations using Streamax Crocus 1.3.40 are affected.
💻 Affected Systems
- Shenzhen Ruiming Technology Streamax Crocus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, or ransomware deployment
Likely Case
Data exfiltration, privilege escalation, and system manipulation
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Public exploit available, remote exploitation possible, no authentication required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer versions if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the sortField parameter to allow only expected values
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns targeting /DeviceFault.do
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test the /DeviceFault.do?Action=Query endpoint with SQL injection payloads in the sortField parameterCheck Version:
Check system version through admin interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- SQL syntax errors in application logs
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests to /DeviceFault.do with suspicious sortField values
- SQL keywords in URL parameters
SIEM Query:
source="web_logs" AND uri="/DeviceFault.do" AND (param="sortField" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--")