CVE-2025-10473: yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10473?
CVE-2025-10473 is classified as a high severity vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2025-10473?
To fix CVE-2025-10473, update the RuoYi application to a version later than 4.8.1, which addresses the SQL injection flaw.
What is the impact of CVE-2025-10473?
CVE-2025-10473 allows attackers to exploit SQL injection through the filterKeyword function, potentially compromising the application's database.
Is CVE-2025-10473 exploitable remotely?
Yes, CVE-2025-10473 can be exploited remotely, making it a critical risk to vulnerable installations.
Which versions of RuoYi are affected by CVE-2025-10473?
RuoYi versions up to and including 4.8.1 are affected by CVE-2025-10473.