{"id":"CVE-2023-24163","details":"SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.","aliases":["GHSA-6c25-cxcc-pmc4"],"modified":"2026-08-12T13:33:53.743708Z","published":"2023-01-31T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24163.json"},"references":[{"type":"WEB","url":"https://gitee.com/dromara/hutool/issues/I6AJWJ#note_15801868"},{"type":"WEB","url":"https://gitee.com/dromara/hutool/issues/I6AJWJ#note_20057806_link"},{"type":"WEB","url":"https://github.com/dromara/hutool/releases/tag/5.8.21"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24163.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24163"},{"type":"REPORT","url":"https://github.com/dromara/hutool/issues/3149"},{"type":"REPORT","url":"https://github.com/google/osv.dev/issues/2195"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/chinabugotech/hutool","events":[{"introduced":"0"},{"fixed":"5889435e0998a4159f4c219ac001a44d50070b8c"}],"database_specific":{"cpe":"cpe:2.3:a:hutool:hutool:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.8.21"}],"source":["DESCRIPTION","CPE_RANGE","REFERENCES"]}}],"versions":["5.8.20","5.8.19","5.8.17","test","5.8.15","5.8.14","5.8.13","5.8.12","5.8.11","5.8.10","5.8.9","5.8.8","5.8.7","5.8.6","5.8.5","5.8.4","5.8.3","5.8.0.M2","5.8.0.M1","5.7.22","5.7.19","5.7.18","5.7.17","5.7.16","5.7.14","5.7.13","5.7.12","5.7.11","5.7.10","5.7.9","5.7.8","5.7.7","5.7.6","5.7.5","5.7.4","5.7.3","5.7.2","5.7.1","5.7.0","5.6.7","5.6.6","5.6.5","5.6.3","5.6.2","5.6.1","5.6.0","5.5.9","5.5.8","5.5.7","5.5.6","5.5.2","5.4.7","5.5.1","5.5.0","5.4.6","5.4.5","5.4.4","5.4.3","5.4.2","5.4.1","5.3.10","5.3.9","5.3.8","5.3.7","5.3.6","5.3.5","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.2.5","5.2.4","5.2.3","5.2.2","5.2.1","5.2.0","5.1.5","5.1.4","5.1.3","5.1.2","5.1.1","5.1.0","5.0.6","5.0.5","5.0.3","5.0.2","5.0.1","5.0.0","4.6.9","4.6.8","4.6.7","4.6.6","4.6.5","4.6.4","4.6.3","4.6.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24163.json","vanir_signatures_modified":"2026-08-12T13:33:53Z","vanir_signatures":[{"digest":{"function_hash":"159625623550601447962817965419903673331","length":299},"id":"CVE-2023-24163-0b91ef51","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"jexlTest"},"deprecated":false},{"target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/AviatorTest.java","function":"simpleTest"},"deprecated":false,"digest":{"function_hash":"1435731277090805105299045363295174462","length":1041},"id":"CVE-2023-24163-279a01d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c"},{"source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"rhinoTest"},"deprecated":false,"digest":{"function_hash":"159625623550601447962817965419903673331","length":299},"id":"CVE-2023-24163-2f20bbca","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"188382802687306480516313101029809971459","length":302},"id":"CVE-2023-24163-32fca760","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"spELTest"}},{"digest":{"function_hash":"260525309837168700495659558450942100251","length":283},"id":"CVE-2023-24163-36d82361","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java","function":"zipTest2"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/AviatorTest.java"},"deprecated":false,"digest":{"line_hashes":["232496852749166267530105042740309307564","76942856807557611212396255844819469805","88745262988244594689080562045212635704","244234201097055932122851924237834703094","219015600886469151008479189124418089060","290292562146228780755008715405917493326","232458532436944472337776573536783710548","336440181253105645549421715695912227776","16368571995140961900713824561653956959","270219071468511389409363127330437592198","285749071733173846554837236409851438821"],"threshold":0.9},"id":"CVE-2023-24163-5863fbc2"},{"signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java","function":"sevenZTest"},"deprecated":false,"digest":{"length":215,"function_hash":"208460344268932300963810428242238596357"},"id":"CVE-2023-24163-6c42408a","signature_type":"Function"},{"source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java","function":"tgzTest"},"deprecated":false,"digest":{"function_hash":"328992195918475128285600273001313539694","length":204},"id":"CVE-2023-24163-70d23b4c","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["144514897152643169372222471191013655518","24346769175578541748781826161309663104","340061501402899213295558579502447419520","215479122852809321072003909508779565371","121028021416670032010915364998144054540","267009614223781273559324337757472549178","329031775616651194151045976022656377802","41505530999254037577787265239635229731","144514897152643169372222471191013655518","24346769175578541748781826161309663104","340061501402899213295558579502447419520","215479122852809321072003909508779565371","144514897152643169372222471191013655518","24346769175578541748781826161309663104","340061501402899213295558579502447419520","215479122852809321072003909508779565371","108037910500966883011822297118547282465","73412124219619570491044869922854629912","268820621443682198134100375757806603165","224238259868856264735872078366642988700","144514897152643169372222471191013655518","24346769175578541748781826161309663104","340061501402899213295558579502447419520","215479122852809321072003909508779565371","144514897152643169372222471191013655518","24346769175578541748781826161309663104","340061501402899213295558579502447419520","33815981842229717118347774032777734841"],"threshold":0.9},"id":"CVE-2023-24163-85d8a81a","signature_type":"Line","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java","function":"sevenZTest2"},"deprecated":false,"digest":{"length":285,"function_hash":"15728671483804354039666163868071643155"},"id":"CVE-2023-24163-862b7b31","signature_type":"Function"},{"source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"mvelTest"},"deprecated":false,"digest":{"function_hash":"159625623550601447962817965419903673331","length":299},"id":"CVE-2023-24163-86d630e9","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java"},"deprecated":false,"digest":{"line_hashes":["265560578323050784786669758111701072914","299953357402655488431206354729536858002","97523217125401251279252824574506220345","77448453622170697503993550395946294920","66553474600816931562283174234455436584","165280041559914728476964908091426351897","322810082462144410702655980900366645772","215237952201019554545642589801928485294","259745932188924441069211020081175346192","325192034253078104714411312273807975987","297082010465753352954074007602907684106","58908509868842117355803994789860606257","232271691303333980514808804549815540779","105221598877067849561180849719442218708","15938384610464799272696774593060068649","280101793086047812762762663073227263739","241153725894031120529354105576193418610","160531574852706544036551420976416885040","178296117957133433695419030238858252988","77950483400597735382445667267050094455","80092892511816172020892942380092500252","119618898433306195393021360168637126599","278134274847944731985566566597641614441","195597388566748981408495255850225215672"],"threshold":0.9},"id":"CVE-2023-24163-91e2a6f9","signature_type":"Line"},{"digest":{"function_hash":"159625623550601447962817965419903673331","length":299},"id":"CVE-2023-24163-96c45965","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"jfireELTest"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"94055602139994406476884038933124371831","length":242},"id":"CVE-2023-24163-d78b49d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/compress/ExtractorTest.java","function":"zipTest"}},{"signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"jexlScriptTest"},"deprecated":false,"digest":{"function_hash":"239211580921859601431190198994790215088","length":254},"id":"CVE-2023-24163-ef4dc30f","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/chinabugotech/hutool/commit/5889435e0998a4159f4c219ac001a44d50070b8c","target":{"file":"hutool-extra/src/test/java/cn/hutool/extra/expression/ExpressionUtilTest.java","function":"qlExpressTest"},"deprecated":false,"digest":{"length":299,"function_hash":"159625623550601447962817965419903673331"},"id":"CVE-2023-24163-f227de01","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}