Shenzhen Ruiming Technology Streamax Crocus SQL Injection Vulnerability in DevicePrint.do Component

A critical SQL injection vulnerability has been identified in the Streamax Crocus O&M Platform version 1.3.44. The issue arises in the DevicePrint.do file, specifically within the Parameter Handler component, where the State parameter is not properly validated. This vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands. Exploitation can be achieved by bypassing login requirements with a manipulated base64-encoded cookie, which decodes to a user ID of 1. Attackers can use time-based blind injection techniques to extract sensitive data from the system, potentially compromising the entire database server.

Impact

Exploitation of this vulnerability allows for arbitrary SQL command execution, with the possibility of extracting sensitive system data and compromising the entire database server.