CVE-2024-57521
CRITICAL 10.0EPSS 0.7%
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
- CVSS v3.1 CNA
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.68% chance of exploitation in the next 30 days, 52nd percentile
- Published
- 2025-12-23
Proof-of-concept exploits (3)
- mrlihd/Ruoyi-4.7.9-SQL-Injection-PoC0★ · 2025-12-23
- mrlihd/CVE-2024-57521-SQL-Injection-PoC0★ · 2025-12-23
- xs2024770/CVE-2024-57521-RuoYi-SQLi0★ · 2026-09-29
Security advisories
- mrlihd/CVE-2024-57521-SQL-Injection-PoC/blob/main/README.md
- https://gitee.com/y_project/RuoYi/commit/ddd858ca732618a472b10eaab2f8e4b45812ffc5
- https://gitee.com/y_project/RuoYi/issues/IBC976