CVE-2025-7902 in RuoYi
Summary
by MITRE • 07/20/2025
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2025
The vulnerability identified as CVE-2025-7902 represents a critical cross site scripting flaw within the yangzongzhuan RuoYi web application framework version 4.8.1 and earlier. This security weakness resides in the SysNoticeController.java file, specifically within the addSave function that handles notice creation and saving operations. The vulnerability classification as problematic indicates significant risk to web application security and user data integrity. The flaw allows malicious actors to inject malicious scripts into the application's notice functionality, potentially compromising user sessions and data confidentiality. The vulnerability's remote exploitability means attackers can leverage this weakness without requiring physical access to the system, making it particularly dangerous in web-facing applications.
The technical implementation of this XSS vulnerability stems from insufficient input validation and output sanitization within the addSave method of the SysNoticeController component. When users submit notice data through the web interface, the application fails to properly sanitize or encode user-supplied content before storing and rendering it within the web page context. This allows attackers to inject malicious JavaScript code that executes in the context of other users' browsers when they view the affected notice. The vulnerability follows the common pattern of reflected XSS where user input flows directly into the application's output without proper security controls. This specific implementation aligns with CWE-79, which describes Cross-Site Scripting vulnerabilities in web applications, and represents a classic injection flaw that violates secure coding practices. The ATT&CK framework categorizes this as a web application attack vector under the T1203 technique for Exploitation for Client Execution.
The operational impact of this vulnerability extends beyond simple script execution, potentially enabling sophisticated attack chains that can compromise user sessions, steal sensitive information, and facilitate further exploitation. Attackers could leverage this vulnerability to perform session hijacking, redirect users to malicious sites, or inject additional malicious code that could persist across multiple user interactions. The public disclosure of the exploit increases the likelihood of real-world exploitation, making immediate remediation essential for organizations using affected versions of the RuoYi framework. The vulnerability affects the core notice functionality of the application, which is typically used for system announcements, user notifications, and administrative communications, making it a prime target for attackers seeking to compromise user trust and system integrity. Organizations may experience unauthorized access, data breaches, and potential regulatory compliance violations due to the exposure of this vulnerability.
Mitigation strategies for CVE-2025-7902 should prioritize immediate patching of the affected RuoYi framework to version 4.8.2 or later, which contains the necessary security fixes. Organizations should implement comprehensive input validation and output encoding mechanisms within the SysNoticeController to sanitize all user-supplied content before processing. The implementation of Content Security Policy headers and proper HTML encoding of dynamic content can provide additional defense-in-depth measures. Security teams should conduct thorough code reviews focusing on all controller methods that handle user input and output rendering, particularly those involving data persistence and display operations. Regular security testing including dynamic application security testing and static code analysis should be implemented to identify similar vulnerabilities in other components. Network segmentation and monitoring of suspicious activities related to notice creation and viewing functions can help detect potential exploitation attempts. The vulnerability's classification as a remote exploit with public disclosure emphasizes the urgency of implementing these security controls to prevent unauthorized access and maintain system integrity.