RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of the attachid parameter in the /Bulletin/AttachDownLoad.aspx file against external SQL input. An attacker can exploit this...