yangzongzhuan RuoYi SQL Injection Vulnerability in Blacklist Handler Component

A SQL injection vulnerability has been identified in yangzongzhuan RuoYi versions through 4.8.1. The issue arises in the Blacklist Handler component, specifically within the 'filterKeyword' function of 'SqlUtil.java'. This vulnerability allows attackers to bypass blacklist protections and manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to '/tool/gen/createTable' with a crafted SQL injection payload that includes SQL keywords and functions, such as 'union' and 'select', while using '%09' to bypass the application's SQL keyword filter. The injection can be verified by observing the application's response or behavior, such as a delay indicating the successful execution of a 'benchmark' function injection.