CVE-2024-25533

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website /WorkFlow/OfficeFileUpdate.aspx. This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements...

CVE-2024-25533

The office automation system RuvarOA (versions v6.01 through v12.01 ) is vulnerable to an SQL injection due to a lack of validation for external SQL statements in the /WorkFlow/OfficeFileUpdate.aspx file. Additionally, error messages in this component leak the website's physical path. An attacker...

CVE-2024-25533

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website /WorkFlow/OfficeFileUpdate.aspx. This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements...