Description
A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| y_project | RuoYi | 4.8.0, 4.8.1 | — |
References
- VDB-337047 | y_project RuoYi getnames code injection vdb-entry technical-description
- VDB-337047 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #710152 | Ruoyi Management System V4.8.1 Code Injection third-party-advisory
- Submit #736164 | https://github.com/yangzongzhuan/RuoYi ruoyi v4.8.2 Template injection (Duplicate) third-party-advisory
- https://github.com/ltranquility/CVE/issues/26 exploit issue-tracking