Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network SQLi with low complexity; PR:L chosen because 'privilege escalation' implies a pre-existing account despite the source's PR:N, with full CIA impact via database compromise.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
AnalysisAI
SQL injection in Crocus version 1.3.44 lets a remote attacker manipulate database queries through the RecordStateMapper.xml mapper and escalate privileges within the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact on confidentiality, integrity and availability. A public write-up/proof-of-concept exists on GitHub, though the flaw is not listed in CISA KEV and EPSS is low (0.19%, 8th percentile), indicating no confirmed active exploitation to date.
Technical ContextAI
The vulnerability is a classic CWE-89 SQL injection rooted in improper neutralization of special elements in an SQL command. The affected artifact, RecordStateMapper.xml, is characteristic of a MyBatis-style SQL mapper file used in Java applications, where SQL statements are defined in XML and parameters are bound at runtime; when a value is interpolated using string substitution (e.g. MyBatis ${} syntax) instead of a parameterized placeholder (#{}), attacker-controlled input is concatenated directly into the query. This lets an attacker alter the query's logic - bypassing authorization checks or reading/writing rows they should not access - which here manifests as privilege escalation. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder with no real vendor/product data, so exact affected components cannot be enumerated from CPE alone.
RemediationAI
No vendor-released patch identified at time of analysis, and no fix version is present in the provided data. Because the root cause is unsafe SQL construction in RecordStateMapper.xml, the specific fix is to convert any dynamic values in that mapper from string-substitution binding to parameterized placeholders (in MyBatis terms, replace ${param} with #{param}) and rebuild/redeploy; upgrade to any vendor release later than 1.3.44 that addresses this once available. As compensating controls until a patch exists: place the application behind a WAF with SQL-injection signatures targeting the affected endpoint/parameter (accepting possible false positives on legitimate input containing SQL metacharacters); restrict network access to the application to trusted management networks or VPN to remove unauthenticated internet exposure (trade-off: reduces accessibility for legitimate remote users); and apply least-privilege on the database account used by Crocus so a successful injection cannot escalate beyond a constrained schema (trade-off: may require careful permission testing to avoid breaking functionality). Review the referenced write-up (https://github.com/Y4y17/CVE/blob/main/Crocus/SQL%20Injection-2.md) to identify the exact parameter for targeted filtering.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today