Paper/Archive/CVE-2024-57521

CVE-2024-57521

mitre — SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function i…

EPSS 0.7%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (ADP)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 52.5.525 × 2010.5 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgitee.com/y_project/RuoYi/commit/ddd858ca732618a472b10eaab2f8e4b45812ffc5 refgitee.com/y_project/RuoYi/issues/IBC976 refgithub.com/mrlihd/Ruoyi-4.7.9-SQL-Injection-PoC refgithub.com/mrlihd/CVE-2024-57521-SQL-Injection-PoC/blob/main/README.md