CVE-2024-25525

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx...

CVE-2024-25525

The RuvarOA office automation system (versions v6.01 through v12.01 ) is vulnerable to a SQL injection flaw in the /WorkFlow/OfficeFileDownload.aspx API endpoint. The root cause is a lack of validation on the filename parameter against external SQL input, which may allow an attacker to execute il...