Read the docs
TI-2022-08656 Aliases CVE-2022-24844

SQL Injection in github.com/flipped-aurora/gin-vue-admin

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01463 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed gin-vue-admin (flipped-aurora): 2.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flipped-auroragin-vue-adminbefore 2.5.12.5.1Patch availableCNA
  • gin-vue-admin Vendorflipped-aurora Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*before 2.5.1Vulnerableflipped-aurora
cpe:2.3:a:postgresql:postgresql:-:*:*:*:*:*:*:*not specified by NVDRunning onPostgreSQL
  • cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·flipped-aurora
  • cpe:2.3:a:postgresql:postgresql:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·PostgreSQL

Remediation

  • Fix · CNA gin-vue-admin (flipped-aurora) Fixed in 2.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24844

References

Exploit 1

Patch 1

  • TI-2022-18720 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal CVSS 3.1CRITICAL 9.8
  • TI-2022-18681 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
  • TI-2022-13903 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
  • TI-2022-13902 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
  • TI-2025-40846 Gin-vue-admin has an arbitrary file deletion vulnerability CVSS 4.0HIGH 8.7
  • TI-2022-06038 Missing authorization in gin-vue-admin CVSS 3.1HIGH 8.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences