CVE-2025-9412: Lostvip Ruoyi-go SQL Injection Vulnerability

CVE-2025-9412 Overview

A SQL injection vulnerability has been identified in lostvip-com ruoyi-go up to version 2.1. This security flaw affects the SelectListByPage function within the file modules/system/dao/DictDataDao.go. The vulnerability allows attackers to manipulate the orderByColumn and isAsc parameters to inject malicious SQL queries, enabling unauthorized database access and manipulation.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to execute arbitrary SQL commands against the backend database, potentially leading to data theft, modification, or destruction of sensitive information stored in the application's database.

Affected Products

• lostvip ruoyi-go versions up to 2.1
• Applications utilizing the DictDataDao.go module with the vulnerable SelectListByPage function
• Deployments exposing the affected endpoints to network access

Discovery Timeline

• August 25, 2025 - CVE-2025-9412 published to NVD
• October 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-9412

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists due to improper neutralization of special elements used in SQL commands within the SelectListByPage function. The affected code resides in modules/system/dao/DictDataDao.go and fails to properly sanitize user-controllable input before incorporating it into SQL queries. Additionally, this vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating a broader injection flaw pattern.

The vulnerability can be exploited remotely by authenticated users with low privileges. Successful exploitation can lead to unauthorized access to database contents, including confidential data, as well as the ability to modify or delete database records.

Root Cause

The root cause of this vulnerability stems from insufficient input validation and parameterization in the SelectListByPage function. The orderByColumn and isAsc parameters are directly concatenated into SQL queries without proper sanitization or the use of prepared statements. This allows attackers to break out of the intended SQL syntax and inject arbitrary SQL commands.

In Go applications using database operations, dynamic SQL construction with user input—particularly for ORDER BY clauses—is a common source of SQL injection vulnerabilities when proper parameterization is not employed.

Attack Vector

The attack vector for CVE-2025-9412 is network-based, allowing remote exploitation. An authenticated attacker with low-level privileges can craft malicious HTTP requests containing SQL injection payloads in the orderByColumn or isAsc parameters. The vulnerable application processes these parameters without adequate validation, passing them directly to the database engine.

The exploitation requires no user interaction and has low attack complexity. An attacker could leverage this vulnerability to extract sensitive data from the database, modify existing records, or potentially escalate privileges within the application if database credentials are stored with elevated permissions.

Technical details and proof-of-concept information are available through the GitHub CVE Issue #6 and GitHub CVE Issue #7 repositories.

Detection Methods for CVE-2025-9412

Indicators of Compromise

• Unusual SQL syntax or error messages in application logs related to DictDataDao.go or the SelectListByPage function
• HTTP requests containing SQL keywords or special characters in orderByColumn or isAsc parameters
• Database query logs showing unexpected ORDER BY clause modifications or UNION-based injection attempts
• Anomalous database access patterns or queries returning unusually large result sets

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in the orderByColumn and isAsc parameters
• Implement application-level logging to monitor and alert on suspicious parameter values containing SQL meta-characters
• Configure database audit logging to track unusual query patterns or unauthorized data access attempts
• Use SentinelOne's application vulnerability detection to identify exploitation attempts targeting this specific endpoint

Monitoring Recommendations

• Enable verbose logging on endpoints utilizing the SelectListByPage function in DictDataDao.go
• Monitor for HTTP 500 errors or database exceptions that may indicate failed injection attempts
• Implement rate limiting on affected endpoints to slow down automated exploitation attempts
• Establish baseline query patterns and alert on deviations that may indicate SQL injection activity

How to Mitigate CVE-2025-9412

Immediate Actions Required

• Review and restrict network access to the affected ruoyi-go application endpoints
• Implement input validation to whitelist acceptable values for orderByColumn and isAsc parameters
• Deploy WAF rules to block SQL injection attack patterns targeting the vulnerable parameters
• Audit database permissions to ensure the application uses least-privilege database accounts

Patch Information

The vendor (lostvip) was contacted about this disclosure but did not respond. As of the last NVD update on October 9, 2025, no official patch has been released. Organizations using ruoyi-go should implement the workarounds below and monitor the official repository for security updates.

For additional vulnerability details, refer to the VulDB CVE Analysis #321253 and VulDB #321253 entries.

Workarounds

• Implement a whitelist-based validation approach for the orderByColumn parameter, allowing only predefined column names
• Restrict the isAsc parameter to accept only ASC or DESC values through explicit validation
• Consider implementing a custom patch to use parameterized queries or an ORM that handles ORDER BY clauses safely
• Deploy network segmentation to limit exposure of the vulnerable application to trusted networks only

# Example input validation approach (implement in application code)
# Whitelist allowed column names for orderByColumn parameter
ALLOWED_COLUMNS="dict_code,dict_sort,dict_label,dict_value,status,create_time"

# Validate isAsc parameter accepts only valid values
ALLOWED_ORDER="ASC,DESC"

# Apply network-level restrictions using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP