CVE-2024-57521

The RuoYi Framework (specifically the RuoYi-Vue permission management system) versions v4.7.9 and before are vulnerable to an authenticated SQL injection (CWE-89) in the createTable function of the ruoyi-generator module. The root cause is a bypass of a blacklist filter in SqlUtil.java; the appli...