SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
Fix
Public exploits 2
- mrlihd/CVE-2024-57521-SQL-Injection-PoC PoC on GitHub
- xs2024770/CVE-2024-57521-RuoYi-SQLi PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://gitee.com/y_project/RuoYi/commit/ddd858ca732618a472b10eaab2f8e4b45812ffc5 Patch, Permissions Required
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 10.0 · ruoyiNVD modified 2026-10-27 18:10
Affected (CPE criteria) 1
cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*
References 4
- https://gitee.com/y_project/RuoYi/commit/ddd858ca732618a472b10eaab2f8e4b45812ffc5 Patch, Permissions Required
- https://gitee.com/y_project/RuoYi/issues/IBC976 Issue Tracking
- https://github.com/mrlihd/CVE-2024-57521-SQL-Injection-PoC/blob/main/README.md Exploit, Third Party Advisory
- https://github.com/mrlihd/Ruoyi-4.7.9-SQL-Injection-PoC Exploit, Third Party Advisory