CVE-2025-10473
📋 TL;DR
This SQL injection vulnerability in RuoYi's blacklist handler allows attackers to execute arbitrary SQL commands on affected systems. It affects RuoYi versions up to 4.8.1 and can be exploited remotely without authentication.
💻 Affected Systems
- yangzongzhuan RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.2 or later
Vendor Advisory: https://github.com/yangzongzhuan/RuoYi
Restart Required: Yes
Instructions:
1. Update RuoYi to version 4.8.2 or later. 2. Restart the application server. 3. Verify the SqlUtil.java file has proper input sanitization.
🔧 Temporary Workarounds
Input Validation Filter
allImplement additional input validation for all user inputs before reaching the filterKeyword function
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in application code
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check RuoYi version in application properties or by examining the SqlUtil.java file for vulnerable filterKeyword functionCheck Version:
Check ruoyi-admin/target/classes/application.yml or pom.xml for versionVerify Fix Applied:
Verify version is 4.8.2+ and SqlUtil.java contains proper SQL injection protections📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL patterns
- Unexpected database errors
Network Indicators:
- HTTP requests containing SQL keywords to RuoYi endpoints
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND (url="*filterKeyword*" OR url="*SqlUtil*" OR method="POST" AND (body="*SELECT*" OR body="*UNION*" OR body="*OR 1=1*"))