PT-2025-15238 · Ruoyi · Ruoyi

Haoran Zhao + 2 · Published 2025-04-07 · Updated 2025-04-09 · CVE-2025-28400

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions RUoYi version 4.8.0

Description The issue allows a remote attacker to escalate privileges via the postID parameter in the edit method.

Recommendations For RUoYi version 4.8.0, avoid using the postID parameter in the affected edit method until the issue is resolved.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-28400

Affected Products

Ruoyi

References · 9

• 🔥 https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28400.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28400 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28400 · Vendor Advisory
• https://github.com/yangzongzhuan/RuoYi · Note
• https://t.me/cvedetector/22330 · Telegram Post
• https://twitter.com/CVEnew/status/1909268543981404348 · Twitter Post
• https://t.me/cvetracker/21003 · Telegram Post
• https://twitter.com/cybercronai/status/1909365988279136367 · Twitter Post
• https://t.me/cvenotify/118490 · Telegram Post