An attacker can manipulate user‑controlled input that is passed to a SQL statement, enabling the execution of arbitrary SQL commands against the Crocus database. The flaw resides in the default configuration file RecordStateMapper.xml, where input is concatenated directly into an SQL query. Successful exploitation allows the attacker to gain elevated privileges, potentially compromising application data and escalating control over the system.

Crocus v1.3.44 is affected by this vulnerability. The issue manifests in the configuration that the application uses to map record states to database operations. Administrators running this specific version without mitigation are exposed.

The CVSS score of 9.8 denotes critical severity. The EPSS score of less than 1% indicates that the probability of mass exploitation is presently low, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote and network‑based, requiring HTTP or another protocol that serves the RecordStateMapper.xml file. Attackers would need to craft a malicious payload that is accepted by the server and reaches the underlying SQL engine, typically by formulating a request that embeds injected code in a parameter processed by the XML handler.