# CVE-2026-52470: Streamax Crocus SQL injection in RecordStateMapper.xml

Source: https://junglewise.ai/threats/cve-2026-52470-streamax-crocus-sql-injection-in-recordstatemapper-xml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-52470 · Severity: info · Published 2026-07-21

A security vulnerability exists in Crocus v.1.3.44, a software solution from Streamax. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially allowing them to steal sensitive user information, transaction records, or escalate their privileges within the system. This could lead to a total compromise of the data managed by the application and disrupt business operations.

## Quick answers

**Is CVE-2026-52470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52470 being exploited in the wild.

**How severe is CVE-2026-52470?** Informational severity, published 21 July 2026.

**Which products and versions are affected?** Streamax Crocus 1.3.44.

**Is there a fix for CVE-2026-52470?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52470 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52470?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Streamax Crocus v.1.3.44 within the RecordStateMapper.xml component. The flaw is specifically an 'order by' injection caused by the use of unsafe '${}' string substitution instead of prepared statements. A remote attacker can exploit this by sending crafted requests to trigger time-based blind SQL injection (e.g., using sleep/delay functions). Successful exploitation allows the attacker to bypass authentication, access data from other databases, and potentially obtain DBA-level permissions on the database server.

## Affected products

- Streamax Crocus 1.3.44

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory

## References

- [https://github.com/Y4y17/CVE/blob/main/Crocus/SQL%20Injection-2.md](https://github.com/Y4y17/CVE/blob/main/Crocus/SQL%20Injection-2.md)