CVE-2022-24844: SQL Injection in github.com/flipped-aurora/gin-vue-admin
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sysautocodepgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login? and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
Other sources
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sysautocodepgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24844?
The severity of CVE-2022-24844 is high with a CVSS score of 8.8.
How does CVE-2022-24844 affect Gin-vue-admin?
CVE-2022-24844 affects Gin-vue-admin versions up to and including 2.5.1.
What is the vulnerability type of CVE-2022-24844?
CVE-2022-24844 is classified as a CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability.
How can I fix CVE-2022-24844?
To fix CVE-2022-24844, it is recommended to update Gin-vue-admin to a version that includes the fix for this vulnerability.
Where can I find more information about CVE-2022-24844?
More information about CVE-2022-24844 can be found in the official GitHub repository of Gin-vue-admin, including the specific PR and security advisory related to this vulnerability.