CVE-2025-10218 is a medium severity flaw in ruoyi-go 2.1, scored 6.3 by NVD. It allows SQL injection through the sortName argument of modules/system/dao/SysRoleDao.go. The record lists no fixed version, so restrict access to the affected page, review the code, and check the vendor for a patch.
What's affected
The record names ruoyi-go 2.1. The affected code is the SelectListPage function in modules/system/dao/SysRoleDao.go of the Background Management Page component. The vulnerable input is the sortName parameter. The record states that the vendor was contacted early about the disclosure and did not respond.
No fixed version appears in the record or in the reference pages I could read. Do not assume a later release is safe. Check the vendor or project page for a patched release, and if none exists, plan on mitigation or replacement.
The record says the exploit has been published and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
First find out whether you run the product at all. Applications like this are usually installed by copying source files to a server, so no package manager records them and a dependency scan may not list them. Gold's free in-browser dependency scan still covers the libraries that sit next to them, and your own asset list is the place to find the application itself.
If you do, look at the code rather than the version number. Search your deployment for the file and the argument:
grep -rn "sortName" /path/to/app/modules/system/dao/SysRoleDao.go
Look for the value being joined into a query string. If you see input concatenated into SQL text, the page is exposed. If it passes through a prepared statement with bound parameters, it is not vulnerable in this way.
Then read your web server access logs for requests to modules/system/dao/SysRoleDao.go that carry long, odd or encoded values in sortName. A hit does not prove a compromise, but it tells you where to look first. Also check which accounts the page can be reached with. The record scores this as reachable remotely, so treat any internet exposed copy as in scope.
What to do now
- Find every copy of ruoyi-go 2.1 in your estate, including test and demo servers.
- Take the application off the public internet where you can. Put it behind a VPN, an IP allow list or a reverse proxy with authentication, at least until it is fixed.
- Check the vendor or project page for a patched release and apply it if one exists.
- If you maintain the code, replace string concatenation in modules/system/dao/SysRoleDao.go with prepared statements and bound parameters, and validate that sortName has the type you expect.
- Make the database account used by the application as limited as it can be. It should not own the schema or read tables it does not need.
- Review logs and the database for unexpected reads or changes since the application went online, and rotate any credentials stored in the database.
- If the product is abandoned and no fix is coming, plan its replacement.
Why it matters
This is SQL injection, listed under CWE-74 (injection), CWE-89 (SQL injection). The application builds a database query by placing the sortName value directly into SQL text. The database cannot tell the developer's query apart from the data a visitor typed, so crafted input can change what the query does. Depending on the database account, that can mean reading records the page was never meant to show, changing data, or deleting it.
The fix for this class is well understood: separate code from data with parameterised queries. Small PHP and Go projects are often built by copying one pattern between many pages, which is why one report is rarely the only one. Review the neighbouring pages for the same pattern. The score of 6.3 reflects network reach, low complexity and low privileges required, with low impact ratings on confidentiality, integrity and availability in the vector. Those ratings are generic, and the real damage depends on the database account and the data stored.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a web application firewall fix CVE-2025-10218?
It can reduce noise, but it does not remove the weakness. The query is still built unsafely inside ruoyi-go 2.1. Fix the code or take the page out of reach.
How do I fix this kind of bug in my own code?
Use prepared statements with bound parameters for every query that takes user input, validate types, and give the database account the least privilege it needs.
Sources
Last reviewed: 19 October 2026.
