Read the docs
TI-2024-25212 Aliases CVE-2024-37896

SQL injection vulnerability in Gin-vue-admin

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities occur when a web application allows users to input data into SQL queries without sufficiently validating or sanitizing the input. Failing to properly enforce restrictions on user input could mean that even a basic form input field can be used to inject arbitrary and potentially dangerous SQL commands. This could lead to unauthorized access to the database, data leakage, data manipulation, or even complete compromise of the database server. This vulnerability has been addressed in commit `53d033821` which has been included in release version 2.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00513 44th percentileScored 2026-11-07
Fix Fixed gin-vue-admin (flipped-aurora): 2.6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flipped-auroragin-vue-adminbefore 2.6.62.6.6Patch availableCNA
  • gin-vue-admin Vendorflipped-aurora Affected before 2.6.6 Fixed in 2.6.6 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:flipped-aurora:gin-vue-admin:2.6.5:*:*:*:*:*:*:*2.6.5——
  • cpe:2.3:a:flipped-aurora:gin-vue-admin:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 — ·—

Remediation

  • Fix · CNA gin-vue-admin (flipped-aurora) Fixed in 2.6.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37896

References

Other 2

  • TI-2022-18720 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal CVSS 3.1CRITICAL 9.8
  • TI-2022-18681 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
  • TI-2022-13903 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
  • TI-2022-13902 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
  • TI-2022-08656 SQL Injection in github.com/flipped-aurora/gin-vue-admin CVSS 3.1HIGH 8.8
  • TI-2025-40846 Gin-vue-admin has an arbitrary file deletion vulnerability CVSS 4.0HIGH 8.7
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences