| Title | yangzongzhuan RuoYi 7995a83e04e1a88aaea5a8a7c50570dffcb145e0 Zip Slip / Path Traversal (CWE-22) |
|---|
| Description | RuoYi v4.8.3 contains a SQL injection vulnerability in the `POST /tool/gen/createTable` endpoint. The `SqlUtil.filterKeyword()` security filter is intended to block dangerous SQL keywords, but a whitespace normalization bug causes it to be completely bypassed. The method at `SqlUtil.java:61` strips all whitespace from the input via `replaceAll("\\p{Z}|\\s", "")`, while the `SQL_REGEX` blacklist at `SqlUtil.java:16` defines 17 of its 26 keywords with trailing spaces (e.g., `"select "`, `"drop "`, `"or "`). After whitespace removal, these trailing-space keywords can never match the normalized string, effectively disabling the filter. An authenticated admin user can submit a `CREATE TABLE ... AS SELECT` statement that passes the filter, flows through Druid's parser as a valid `MySqlCreateTableStatement`, and is executed directly via MyBatis `${sql}` raw interpolation at `GenTableMapper.xml:169`. This allows arbitrary data exfiltration from any database table, including user credentials. |
|---|
| Source | ⚠️ https://github.com/yangzongzhuan/RuoYi/issues/340 |
|---|
| User | poppingsnack (UID 102221) |
|---|
| Submission | 10/20/2026 10:04 (25 days ago) |
|---|
| Moderation | 11/14/2026 08:12 (25 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 371141 [RuoYi up to 4.8.3 /tool/gen/createTable sql injection] |
|---|
| Points | 0 |
|---|