CVE-2025-7901 PoC — RuoYi 代码注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-7901.yaml

Associated Vulnerability

Title:RuoYi 代码注入漏洞 (CVE-2025-7901)
Description:RuoYi是中国若依（RuoYi）个人开发者的一款后台管理系统。 RuoYi 4.8.1及之前版本存在代码注入漏洞，该漏洞源于对文件/swagger-ui/index.html中参数configUrl的错误操作导致跨站脚本。

Description

yangzongzhuan RuoYi = 4.8.1 contains a stored XSS caused by manipulation of the \"configUrl\" argument in /swagger-ui/index.html of Swagger UI, letting remote attackers execute scripts, exploit requires crafted request.

File Snapshot


 id: CVE-2025-7901

info:
  name: yangzongzhuan RuoYi - DOM Based XSS
  author: Nikhil Patidar
  seve

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.