CVE-2023-49371
Published: 01 December 2023
Summary
CVE-2023-49371 is a critical-severity SQL Injection (CWE-89) vulnerability in Ruoyi Ruoyi. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
RuoYi versions up to v4.6 contain a SQL injection vulnerability, tracked as CVE-2023-49371 and assigned CWE-89, that is reachable at the endpoint /system/dept/edit. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with impacts rated high for confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the affected endpoint and execute arbitrary SQL commands against the underlying database. Successful exploitation can therefore result in full read, write, or delete operations on database contents, potentially leading to data exfiltration, privilege escalation within the application, or service disruption.
Public references consist of proof-of-concept disclosures on GitHub that demonstrate the injection vector; no official vendor advisory or patch information is included in the provided sources. The associated EPSS score currently stands at 0.8445 with a recorded peak of 0.8481, indicating sustained and elevated exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-3196
Vulnerability details
RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.