CVE-2024-25507

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the emailattachid parameter at /LHMail/AttachDown.aspx...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /AddressBook/addresspublicshow.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of the templateid parameter in the /SysManage/wftemplatechildfieldlist.aspx file against external SQL input. An attacker can exploi...

CVE-2024-25513

CVE-2024-25513 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability exploitable through the file_id parameter of /CorporateCulture/kaizen_download.aspx. The issue arises from lack of input validation on external SQL input, enabling an attacker to execute arbitrary SQL commands and...

CVE-2024-25508

RuvarOA is affected in v6.01–v12.01 by a SQL injection via the id parameter in the bulletin_template_show.aspx endpoint. Root cause: lack of input validation on id leading to arbitrary SQL execution that can read/modify data. References from multiple sources confirm the vulnerable versions and th...

CVE-2024-25510

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...

CVE-2024-25512

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attachid parameter at /Bulletin/AttachDownLoad.aspx...

PT-2024-20971 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the sys file storage id parameter at the "/WorkFlow/wf file download.aspx" API endpoint...

PT-2024-20970 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/bulletin/bulletin template show.aspx" API endpoint. Recommendations: For...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by the lack of validation of the emailattachid parameter in the /LHMail/AttachDown.aspx file against external SQL input. An attacker can exploit this...

CVE-2024-25509

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkFlow/wffiledownload.aspx...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /AddressBook/addresspublicnew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

CVE-2024-25510

RuvarOA v6.01 and v12.01 are affected by an SQL injection in the id parameter of /AddressBook/address_public_show.aspx. The root cause is lack of validation for external SQL statements, enabling attackers to execute arbitrary SQL and potentially steal sensitive data. Public sources (CNVD, CNNVD, ...

CVE-2024-25513

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /CorporateCulture/kaizendownload.aspx...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /bulletin/bulletintemplateshow.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

CVE-2024-25511

CVE-2024-25511 affects RuvarOA v6.01 and v12.01, where an SQL injection can be triggered via the id parameter in /AddressBook/address_public_new.aspx. The underlying issue is lack of validation of external SQL statements, enabling attackers to execute arbitrary SQL commands and potentially access...

CVE-2024-25514

RuvarOA versions 6.01 and 12.01 are affected by a SQL injection vulnerability in the template_id parameter of /SysManage/wf_template_child_field_list.aspx. The issue originates from lack of input validation in the affected endpoint. Documented impact includes potential data exposure or manipulati...

CVE-2024-25507

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the emailattachid parameter at /LHMail/AttachDown.aspx...

PT-2024-20975 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the file id parameter at the "/CorporateCulture/kaizen download.aspx" API endpoint. Recommendation...

PT-2024-20973 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/AddressBook/address public new.aspx" API endpoint. Recommendations: For...