Vulnerability · Published Apr 13, 2022 · Assigned by GitHub_M

CVE-2022-24844SQL Injection in github.com/flipped-aurora/gin-vue-admin

High 8.1

In plain English

A high-severity SQL injection in gin-vue-admin from flipped-aurora. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.5%top 26.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
flipped-aurora	gin-vue-admin	< 2.5.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-5g92-6hpp-w425 x_refsource_CONFIRM
https://github.com/flipped-aurora/gin-vue-admin/pull/1024 x_refsource_MISC