A critical SQL injection vulnerability in Crocus allows unauthenticated remote attackers to execute arbitrary SQL queries, leading to full database compromise.

This vulnerability resides in the RecordStateMapper.xml file where user-supplied input is improperly concatenated into SQL queries. An unauthenticated attacker can exploit this over the network to inject arbitrary SQL commands.

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. By bypassing authentication to execute arbitrary SQL, an attacker can extract, modify, or delete sensitive business data, leading to severe reputational damage and potential loss of operational continuity.

Immediate Action: Update to a version of Crocus beyond 1.3.44 as soon as the vendor provides the updated package.

Proactive Monitoring: Review database audit logs for any unexpected query execution or unauthorized access to sensitive tables.

Compensating Controls: Implement strict input validation and parameterized queries at the application layer, and deploy a WAF to block malicious SQL injection payloads at the network edge.

Public Exploit Available: Yes, a public proof-of-concept exists.

This is a critical security flaw that requires immediate attention. Security teams must verify their current version of Crocus and apply the latest available updates to mitigate the risk of remote database exploitation.