An SQL Injection flaw exists in the /tool/gen/createTable endpoint of RuoYi version 4.8.2. The flaw is present in the code generation module and allows an authenticated attacker with administrative privileges to inject arbitrary SQL statements, which could lead to unauthorized access to sensitive database information. This corresponds to CWE-89.

RuoYi v4.8.2 is affected. The vulnerability pertains to the code generation module exposed through the /tool/gen/createTable REST endpoint. No other product versions are listed in the current advisory.

The vulnerability receives a CVSS score of 9.8, indicating critical severity, but the EPSS score is less than 1%, suggesting a low current exploitation probability. The flaw is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would require authenticated administrative access to the RuoYi application and she has privilege to invoke the code generation endpoint. Even with the low EPSS, the high CVSS warrants prompt mitigation, especially for environments using the default configuration and exposing the endpoint to potential threat actors.