A critical SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus 1.3.44 allows unauthenticated remote attackers to compromise database integrity.

The vulnerability is a SQL injection (CWE-89) located in the DevicePrint.do endpoint within the Parameter Handler component. An unauthenticated attacker can inject malicious SQL commands through the State parameter to interact with the underlying database.

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the device database, potentially leading to unauthorized data access or modification. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of device management systems. If the database contains administrative credentials or sensitive configuration data, this could lead to a full system compromise.

Immediate Action: Since no vendor patch is currently available, restrict access to the affected device management interface to trusted networks only and block requests containing suspicious SQL patterns.

Proactive Monitoring: Monitor network traffic and application logs for unusual GET requests targeting the DevicePrint.do endpoint, specifically looking for SQL syntax characters within the State parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious input targeting the known vulnerable parameter and endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided by the researcher at the referenced Feishu link.

Organizations utilizing Streamax Crocus 1.3.44 must treat this vulnerability with high priority due to the presence of a public proof-of-concept and the lack of a vendor-provided fix. Immediately isolate the device from public internet access and apply strict ingress filtering to mitigate the risk of unauthorized remote exploitation.