CVE-2025-9411
📋 TL;DR
This CVE describes an SQL injection vulnerability in the lostvip-com ruoyi-go framework's login information service. Attackers can manipulate the 'isAsc' parameter to execute arbitrary SQL commands, potentially compromising database integrity and confidentiality. Organizations using ruoyi-go versions up to 2.1 are affected.
💻 Affected Systems
- lostvip-com ruoyi-go
📦 What is this software?
Ruoyi Go by Lostvip
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data exfiltration, modification, or deletion; potential privilege escalation to system-level access.
Likely Case
Unauthorized data access and extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit details are publicly available but require understanding of the application structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.2 or later
Vendor Advisory: https://github.com/lostvip-com/ruoyi-go
Restart Required: No
Instructions:
1. Update ruoyi-go to version 2.2 or later. 2. Replace vulnerable SelectPageList function with parameterized queries. 3. Validate all user inputs before processing.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the isAsc parameter before processing
Implement input validation in LoginInforService.go to restrict isAsc to expected values only
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the isAsc parameter
- Restrict network access to the application to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if ruoyi-go version is 2.1 or earlier and if LoginInforService.go contains the vulnerable SelectPageList functionCheck Version:
Check package.json or project configuration for ruoyi-go versionVerify Fix Applied:
Verify ruoyi-go version is 2.2 or later and that parameterized queries are used in SelectPageList📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in application logs
- Multiple failed login attempts with SQL-like payloads in isAsc parameter
Network Indicators:
- HTTP requests containing SQL injection payloads in isAsc parameter
SIEM Query:
source="application_logs" AND ("isAsc" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE"))