CVE-2025-9413
📋 TL;DR
This SQL injection vulnerability in lostvip-com ruoyi-go allows attackers to manipulate database queries through the orderByColumn/isAsc parameters. It affects ruoyi-go versions up to 2.1 and can be exploited remotely to potentially access, modify, or delete database contents. Organizations using vulnerable versions of this software are at risk.
💻 Affected Systems
- lostvip-com ruoyi-go
📦 What is this software?
Ruoyi Go by Lostvip
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential privilege escalation to system-level access.
Likely Case
Unauthorized data access and extraction from the application database.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit has been published and may be used; manipulation of orderByColumn/isAsc parameters causes SQL injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to version 2.2 or later if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for orderByColumn and isAsc parameters to prevent SQL injection
Parameterized Queries
allModify the SelectListByPage function to use parameterized queries or prepared statements
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check ruoyi-go version; if version ≤ 2.1, examine modules/system/system_router.go for vulnerable SelectListByPage functionCheck Version:
Check application version in configuration files or via application interfaceVerify Fix Applied:
Test orderByColumn and isAsc parameters with SQL injection payloads; verify no database manipulation occurs📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation attempts
Network Indicators:
- SQL injection patterns in HTTP requests to system_router endpoints
SIEM Query:
web_requests WHERE url CONTAINS 'system_router' AND (params CONTAINS 'orderByColumn' OR params CONTAINS 'isAsc') AND params MATCHES '.*[;'"].*'