CNNVD-202508-2924 Information

Aug 25, 2025 cve

CNNVD ID

CNNVD-202508-2924

CVE-2025-9412

CNNVD Published: 2025-08-25

Description (Chinese)

ruoyi-go是lostvip.com个人开发者的一个后台管理系统。 ruoyi-go 2.1及之前版本存在安全漏洞，该漏洞源于文件modules/system/dao/DictDataDao.go中SelectListByPage函数对orderByColumn/isAsc参数处理不当，可能导致SQL注入。

Description (English)

Ruoyi-go is a back-office management system for individual developers in lostvip.com. The ruoyi-go 2.1 and previous versions had a security loophole, which originated from the improper handling of the orderByColumn/isAsc parameters by the SelectListByPage function in document Modeules/system/doo/DictDataDao.go, which could lead to the injection of SQL.

Hazard Level

High

Vulnerability Type

其他

Affected Vendor

个人开发者

Published

2025-08-25

Last Modified

2026-02-24

References

https://vuldb.com/?submit.633705 https://vuldb.com/?submit.633704 https://vuldb.com/?id.321253 https://vuldb.com/?ctiid.321253 https://github.com/on-theway/cve/issues/7 https://github.com/on-theway/cve/issues/6 https://nvd.nist.gov/vuln/detail/CVE-2025-9412

Share on: