CVE-2024-25509

CVE-2024-25509 affects RuvarOA v6.01 and v12.01, where a SQL injection exists via the sys_file_storage_id parameter in the /WorkFlow/wf_file_download.aspx endpoint. Root cause appears to be lack of input validation for that parameter, enabling SQL statements to be interpreted by the database. Imp...

CVE-2024-25508

RuvarOA is affected in v6.01–v12.01 by a SQL injection via the id parameter in the bulletin_template_show.aspx endpoint. Root cause: lack of input validation on id leading to arbitrary SQL execution that can read/modify data. References from multiple sources confirm the vulnerable versions and th...

CVE-2024-25512

CVE-2024-25512 affects RuvarOA v6.01 and v12.01. The vulnerability is a SQL injection in the /Bulletin/AttachDownLoad.aspx endpoint via the attach_id parameter, arising from input validation gaps. Impact described across sources includes the ability to execute arbitrary SQL and exfiltrate sensiti...

CVE-2024-25507

RuvarOA v6.01 and v12.01 are affected by a SQL injection via the email_attach_id parameter in /LHMail/AttachDown.aspx. Root cause: lack of validation of external SQL input in that endpoint. CVSS v3.1 base score 9.4 (CRITICAL); impact: Confidentiality and Integrity high, Availability low. No remed...

CVE-2024-25514

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the templateid parameter at /SysManage/wftemplatechildfieldlist.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-25510

RuvarOA v6.01 and v12.01 are affected by an SQL injection in the id parameter of /AddressBook/address_public_show.aspx. The root cause is lack of validation for external SQL statements, enabling attackers to execute arbitrary SQL and potentially steal sensitive data. Public sources (CNVD, CNNVD, ...

Unauthorized Access Vulnerability in LuvarOA Collaboration Office Platform

Luvar RuvarOA collaborative office system adopts three-tier structure model, the system development adopts java technology, the database supports Mysql, SQL Server, Oracle and so on. There is an unauthorized access vulnerability in Luvar RuvarOA Office, which can be exploited by attackers to obta...

SQL Injection Vulnerability in RuvarOA Collaboration Office System of Guangzhou Luhua Computer Co.

Luvar RuvarOA collaborative office system adopts three-tier structure model, the system development adopts java technology, the database supports Mysql, SQL Server, Oracle and so on. There is a SQL injection vulnerability in the RuvarOA system of Guangzhou Luhua Computer Co., Ltd, which can be...

RuvarOA /ContractManage/get_company.aspx SQL Injection Vulnerability

No description provided by source...

RuvarOA /flow/flow_get_if_value.aspx SQL Injection Vulnerability

No description provided by source...

ruvar OA系统 bulletin_template_show.aspx 参数id SQL注入漏洞

0x01 框架概述 璐华RuvarOA机关事业版办公自动化系统是广州市璐华计算机科技有限公司专门针对我国党政机关、大型企事业单位开发，采用组件技术和Web技术相结合，基于Windows平台，构建在大型关系数据库管理系统基础上的，以行政办公为核心，以集成融通业务办公为目标，将网络与无线通讯等信息技术完美结合在一起设计而成的新型办公自动化应用系统。 该系统根据中国国情和行政管理的惯例，旨在从根本上提高办公及行政管理的效率和水平，并借助与计算机与信息科技的成果为领导和决策人员提供全面及时的决策支持服务，是颇具实用性、先进性、经济性的政府机关协同办公系统。...

RuvarOA协同办公软件 get_condiction.aspx SQL注入漏洞

No description provided by source...

RuvarOA协同办公软件Include/get_dict.ashx bt_id参数SQL注入漏洞

No description provided by source...

SQL Injection Vulnerability in RuvarOA Collaboration Office Platform of Guangzhou Luhua Computer Co.

Guangzhou Luhua Computer Co., Ltd RuvarOA collaborative office platform is a kind of enterprise office system. The product /DepartmentPlan/departmentplanattachdownload.aspxsysfilestorageid= there is a SQL injection vulnerability, the vulnerability parameter is sysfilestorageid, the type of GET...

RuvarOA 多处SQL注入漏洞

No description provided by source...