236 matches found
RuvarOA 安全漏洞
RuvarOA is an office automation system of China Ruvar Company. A security vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by a SQL injection vulnerability in the btid parameter of the /include/getdict.aspx file...
CVE-2024-25532
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the btid parameter at /include/getdict.aspx...
CVE-2024-25532
CVE-2024-25532 affects RuvarOA v6.01 and v12.01. The vulnerability is a SQL injection via the bt_id parameter in /include/get_dict.aspx, as described across multiple sources (NVD/Red Hat/CVE listings). The initial data indicates a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no aut...
CVE-2024-25528
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklogtemplateshow.aspx...
CVE-2024-25521
CVE-2024-25521 affects RuvarOA v6.01 and v12.01. A SQL injection vulnerability exists in the get_company.aspx endpoint via the txt_keyword parameter, caused by lack of input validation against external SQL statements. Reported impact includes the ability to perform illegal SQL commands to access ...
CVE-2024-25528
CVE-2024-25528 affects RuvarOA v6.01 and v12.01. A SQL injection vulnerability exists via the id parameter at the endpoint /PersonalAffair/worklog_template_show.aspx (also described as related to the /worklog template show.aspx path in several reports). Root cause: improper handling of user-suppl...
PT-2024-20982 · Ruvaroa · Ruvaroa
Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the txt keyword parameter at the "get company.aspx" endpoint. Recommendations: For versions 6.01...
CVE-2024-25523
RuvarOA v6.01 and v12.01 are affected by an SQL injection vulnerability in the /filemanage/file_memo.aspx endpoint, exploitable via the file_id parameter. Root cause: lack of input validation against external SQL input. Impact (per sources): potential unauthorized data theft and data integrity/av...
RuvarOA 安全漏洞
RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of the sysfilestorageid parameter of the /WorkPlan/WorkPlanAttachDownLoad.aspx file against external SQL input. This vulnerability...
CVE-2024-25530
RuvarOA v6.01 and v12.01 are affected by a SQL injection in the PageID parameter of /WebUtility/get_find_condiction.aspx due to unvalidated SQL statements. Root cause: lack of validation in PageID handling. Impact: high risk of unauthorized database access and data exposure (CVSS v3.1 base score ...
CVE-2024-25518
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the templateid parameter at /WorkFlow/wfgetfieldsapprove.aspx...
PT-2024-20984 · Ruvaroa · Ruvaroa
Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: A SQL injection issue was discovered via the file id parameter at the "/filemanage/file memo.aspx" API endpoint. This allows for potential exploitation. Recommendations: For versions 6.01 throu...
CVE-2024-25524
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx...
CVE-2024-25521
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txtkeyword parameter at getcompany.aspx...
CVE-2024-25519
CVE-2024-25519 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability via the idlist parameter in /WorkFlow/wf_work_print.aspx. The root cause is lack of validation of externally entered SQL statements against the idlist parameter, enabling potentially dangerous SQL execution and da...
CVE-2024-25520
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sysblogtemplatenew.aspx...
CVE-2024-25522
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the officemissiveid parameter at /WorkFlow/wfworkformsave.aspx...
CVE-2024-25529
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wfofficefilehistoryshow.aspx...
PT-2024-20995 · Ruvaroa · Ruvaroa
Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: Error messages in RuvarOA were discovered to leak the physical path of the website, specifically at the /WorkFlow/OfficeFileUpdate.aspx endpoint. This issue can allow attackers to write files t...