| Title | RuoYi V4.8.3 and prior SQL Injection |
|---|
| Description | Ruoyi is an open-source Java rapid development framework.
A SQL injection vulnerability exists in the query module of Ruoyi framework,via the /tool/gen/createTable endpoint.
This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection.
Although there is a blacklist filter, it is incomplete. It matches `select ` (with a trailing space) instead of the standalone keyword `select`. Keywords such as `Benchmark` are not filtered, so bypass methods exist.
Successful exploitation could allow an attacker to read sensitive database information.
Affected versions: 4.8.3 and prior. |
|---|
| Source | ⚠️ https://github.com/svmm0r/vulandpoc/blob/main/RuoYi%20createTable%20SQL%20Injection |
|---|
| User | Anonymous User |
|---|
| Submission | 09/28/2026 14:00 (27 days ago) |
|---|
| Moderation | 10/25/2026 09:26 (27 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 371141 [RuoYi 4.8.2 /tool/gen/createTable sql injection] |
|---|
| Points | 0 |
|---|