CVE-2025-9412

lostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74 CWE-89

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

25 Aug 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability was detected in lostvip-com ruoyi-go up to 2.1. This affects the function SelectListByPage of the file modules/system/dao/DictDataDao.go. The manipulation of the argument orderByColumn/isAsc results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

lostvip-com · ruoyi-go

References

https://github.com/on-theway/cve/issues/6 https://github.com/on-theway/cve/issues/7 https://vuldb.com/?ctiid.321253 https://vuldb.com/?id.321253 https://vuldb.com/?submit.633704 https://vuldb.com/?submit.633705