CVE-2024-25519

CVE-2024-25519 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability via the idlist parameter in /WorkFlow/wf_work_print.aspx. The root cause is lack of validation of externally entered SQL statements against the idlist parameter, enabling potentially dangerous SQL execution and da...

CVE-2024-25533

CVE-2024-25533 affects RuvarOA v6.01–v12.01. Error messages disclose the server path at /WorkFlow/OfficeFileUpdate.aspx and, per multiple sources, allow writing files or executing arbitrary SQL via crafted statements due to insufficient input validation. Affected versions: 6.01–12.01. Root cause ...

CVE-2024-25531

CVE-2024-25531 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability exploitable via the PageID parameter in /WebUtility/SearchCondiction.aspx. Root cause: lack of input validation on PageID allows external SQL input to be executed. Impacts include potential unauthorized access to ...

CVE-2024-25530

RuvarOA v6.01 and v12.01 are affected by a SQL injection in the PageID parameter of /WebUtility/get_find_condiction.aspx due to unvalidated SQL statements. Root cause: lack of validation in PageID handling. Impact: high risk of unauthorized database access and data exposure (CVSS v3.1 base score ...

CVE-2024-25529

RuvarOA v6.01 and v12.01 are affected by a SQL injection in the id parameter of /WorkFlow/wf_office_file_history_show.aspx. Root cause is lack of input validation on the id parameter, enabling unauthorized SQL execution. Impact per CVSS: high confidentiality, integrity, and availability impact (s...

CVE-2024-25527

RuvarOA v6.01 and v12.01 contain a SQL injection vulnerability in the id parameter of /PersonalAffair/worklog_template_show.aspx due to lack of validation of externally entered SQL statements. This could allow an attacker to execute arbitrary SQL commands to access or exfiltrate data, as describe...

CVE-2024-25523

RuvarOA v6.01 and v12.01 are affected by an SQL injection vulnerability in the /filemanage/file_memo.aspx endpoint, exploitable via the file_id parameter. Root cause: lack of input validation against external SQL input. Impact (per sources): potential unauthorized data theft and data integrity/av...

CVE-2024-25520

CVE-2024-25520 affects RuvarOA v6.01 and v12.01. A SQL injection exists via the id parameter to /SysManage/sys_blogtemplate_new.aspx, stemming from a lack of input validation. Attackers could execute arbitrary SQL commands, with potential exposure or manipulation of database data (per CNVD/Red Ha...

CVE-2024-25518

RuvarOA v6.01 and v12.01 expose a SQL injection via the template_id parameter on /WorkFlow/wf_get_fields_approve.aspx. Root cause: lack of validation for template_id input, enabling arbitrary SQL execution and potential data disclosure as described across CVE-2024-25518 and related feeds. Documen...

PT-2024-20985 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the sys file storage id parameter at the "/WorkPlan/WorkPlanAttachDownLoad.aspx" API endpoint...

PT-2024-20979 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the template id parameter at the "/WorkFlow/wf get fields approve.aspx" API endpoint...

PT-2024-20980 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: A SQL injection issue was discovered via the idlist parameter at the "/WorkFlow/wf work print.aspx" API endpoint. This allows for potential exploitation. Recommendations: For versions 6.01...

PT-2024-20982 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the txt keyword parameter at the "get company.aspx" endpoint. Recommendations: For versions 6.01...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of external SQL statements in the PageID parameter of the /WebUtility/getfindcondiction.aspx file. An attacker can exploit this...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by the lack of validation of the fileid parameter of the /filemanage/filememo.aspx file against external SQL input. An attacker can exploit this vulnerability t...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A security vulnerability exists in RuvarOA v6.01 and v12.01, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /SysManage/sysblogtemplatenew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

CVE-2024-25523

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /filemanage/filememo.aspx...

CVE-2024-25527

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...

CVE-2024-25524

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx...