SQL Injection Vulnerability in RuoYi Web Framework by Y_project
CVE-2024-57521

10CRITICAL

Key Information:

Vendor

Y_project

Status
RuoYi
Vendor
CVE Published:
23 December 2025

What is CVE-2024-57521?

A SQL Injection vulnerability exists in RuoYi versions 4.7.9 and earlier. This flaw enables a remote attacker to inject malicious SQL queries through the createTable function in SqlUtil.java, potentially leading to unauthorized code execution and access to sensitive data. Users are advised to upgrade to the latest version to mitigate this risk. For more technical details and proof of concept, refer to associated resources.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://gitee.com/y_project/RuoYi/commit/ddd858ca732618a4...
https://gitee.com/y_project/RuoYi/issues/IBC976
https://github.com/mrlihd/Ruoyi-4.7.9-SQL-Injection-PoC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.