Shenzhen Ruiming Technology Streamax Crocus 1.3.44 contains a flaw in the OperateStatistic.do servlet where the VehicleID parameter is concatenated directly into SQL statements. An attacker who can reach the web interface can supply a crafted VehicleID value to inject arbitrary SQL. This flaw is a textbook example of CWE-89 (SQL Injection) combined with improper encoding (CWE-74) and can lead to unauthorized data disclosure, modification, or even remote code execution if the database connection is granted excessive privileges. The vulnerability is exploitable over the network without authentication.

The affected product is Shenzhen Ruiming Technology Streamax Crocus version 1.3.44. No other versions or products are listed as vulnerable in the available data.

The CVSS score for this vulnerability is 6.9, which places it in the medium severity range. The EPSS score is not available, but the vulnerability is publicly disclosed and an exploit has been made available. The attack can be launched remotely by sending a specially crafted HTTP request to OperateStatistic.do. Because the flaw allows SQL injection, attackers could exfiltrate sensitive data or elevate privileges, potentially compromising the entire system. Although the vulnerability is not yet listed in the CISA KEV catalog, the presence of a public exploit and the remote nature of the attack vector mean that systems running this product should be treated as high risk until a patch is applied.