CVE-2024-37896

Vulnerability

Gin-vue-admin, a backstage management system, contains a SQL injection vulnerability in versions up to and including v2.6.5. The flaw resides in the SysExportTemplateService.ExportExcel function, where the order parameter from user input is passed directly to an SQL ORDER BY clause without sufficient validation or sanitization [1][2]. This allows an attacker to inject arbitrary SQL commands.

Exploitation

The attack vector is the /api/sysExportTemplate/exportExcel endpoint [2]. By manipulating the order parameter in the request, an unauthenticated or authenticated user can inject malicious SQL code. The vulnerability requires no special privileges beyond network access to the API [2].

Impact

Successful exploitation can lead to unauthorized access to the database, data leakage, data manipulation, and potentially full compromise of the database server. Given the severity (CVSS 8.8), the risk to confidentiality, integrity, and availability is high [2].

Mitigation

The issue has been addressed in commit 53d033821 [1], which introduces validation to ensure the order parameter only references existing table columns and restricts ordering directions to ASC/DESC. This fix is included in release version 2.6.6 [2]. Users should upgrade immediately; no workarounds are available [2].