CVE-2024-57437

Summary

CVE-2024-57437 is a newly disclosed SQL injection vulnerability affecting RuoYi v4.8.0. An attacker can exploit this issue by manipulating the orderby parameter in the /monitor/online/list endpoint. Successful exploitation may allow the attacker to execute unauthorized SQL queries, potentially leading to unintended data disclosure or unauthorized system access. Organizations using RuoYi are urged to update to a patched version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.