Gin-vue-admin SQL Injection Vulnerability

CVE-2024-37896

What is CVE-2024-37896?

The Gin-vue-admin is a management system built on Vue and Gin. A vulnerability exists in versions up to v2.6.5 that allows SQL injection due to insufficient validation or sanitization of user input in SQL queries. This flaw can enable attackers to input malicious SQL commands through seemingly harmless form fields, leading to potential unauthorized access to the database, data leakage, and manipulation. Furthermore, without proper restrictions on user input, the possibility of complete database server compromise arises. The vulnerability has been addressed in version 2.6.6, following the amendment made in commit 53d033821. Users are strongly advised to upgrade as there are currently no viable workarounds.

References