Description
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-24
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the GoViewDataServiceImpl.getDataBySQL method of the ruoyi‑vue‑pro system. An attacker can supply a crafted "sql" argument that is concatenated into a database query without proper sanitization, allowing arbitrary SQL code to be executed on the database server. Remote exploitation is possible, meaning an unauthenticated or authenticated user over the network could trigger the flaw, potentially exposing sensitive data, modifying records, or enabling further attacks.

Affected Systems

The affected vendors are YunaiV and zhijiantianya, both distributing the ruoyi‑vue‑pro application. Versions up to 2026.08 contain the flaw in the GoView Data Endpoint component (yudao‑module‑report). No later releases are reported to be affected.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity. No EPSS score is currently available, and the vulnerability is not listed in CISA KEV, suggesting limited public exploit evidence. Nonetheless, the flaw can be triggered from remote locations via the public API and would allow a remote attacker to execute arbitrary SQL commands against the database.

Generated by OpenCVE AI on September 25, 2026 at 04:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch or upgrade to a version of ruoyi‑vue‑pro that corrects the query sanitization issue.
  • Restrict exposure of the GetDataBySQL endpoint with network‑level controls or mandatory authentication before use.
  • On the server side, validate the "sql" argument against a whitelist or rewrite the code to use parameterized queries, ensuring only safe requests reach the database.

Generated by OpenCVE AI on September 25, 2026 at 04:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection
First Time appeared Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*
cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*
Vendors & Products Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yunaiv Ruoyi-vue-pro
Zhijiantianya Ruoyi-vue-pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-24T18:51:29.736Z

Reserved: 2026-09-24T11:34:12.531Z

Link: CVE-2026-97321

cve-icon Vulnrichment

Updated: 2026-09-24T18:51:05.285Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T19:17:21.430

Modified: 2026-09-24T21:08:55.030

Link: CVE-2026-97321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:45:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')