CVE-2022-24844 SQL Injection in github.com/flipped-aurora/gin-vue-admin

High 8.1 Published 13 Apr 2022 Updated 22 Apr 2025

Authenticated users can execute arbitrary SQL commands if PostgreSQL is used, allowing data access or modification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24844?

CVE-2022-24844 is a high-severity SQL injection vulnerability in flipped-aurora gin-vue-admin, published on 13 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.

Weakness: CWE-89

Which versions are affected by CVE-2022-24844?

It affects 1 product.

Products include Gin-Vue-Admin Project Gin-Vue-Admin.

How do I fix CVE-2022-24844?

No fix has been published for CVE-2022-24844 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-24844 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24844 exists.

Sources

Also known as GHSA-5g92-6hpp-w425.