CVE-2020-11819

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution...

Sql injection

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

Cross site request forgery (csrf)

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

Sql injection

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

Sql injection

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reportsid POST parameter...

Code injection

In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting...

Command injection

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution...

CVE-2020-11819

CVE-2020-11819 affects Rukovoditel up to version 2.5.2. The vulnerability arises from an input-validation/weak path handling flaw that lets an attacker inject an arbitrary .php file location in place of a language file, enabling remote command execution via local file inclusion. Public references...

CVE-2020-11819

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

CVE-2020-11820

CVE-2020-11820 affects Rukovoditel 2.5.2 with a SQL injection vulnerability caused by improper handling of the entities_id parameter. The CVE entry indicates high/critical impact (CVSS v3.1 base 9.8; network vector, no auth, user interaction not required) and mentions no exploitation details or p...

CVE-2020-11818

CVE-2020-11818 affects Rukovoditel 2.5.2. The vulnerability arises from a CSRF protection mechanism using a form_session_token that can be bypassed with another user’s valid token, allowing an attacker to change the Admin password and escalate privileges. Documents consistently describe this CSRF...

CVE-2020-11818

In Rukovoditel 2.5.2 has a formsessiontoken value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges...

CVE-2020-11815

In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a command on the server. This specific attack only occurs without the Maintenance Mode setting...

CVE-2020-11815

In Rukovoditel 2.5.2, the vulnerability arises from how the application handles file uploads via manipulated Content-Type headers, enabling an attacker to upload arbitrary files and execute commands on the server when Maintenance Mode is off. Affected component: file upload handling in Rukovodite...

CVE-2020-11816

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reportsid POST parameter...

CVE-2020-11816

CVE-2020-11816 affects Rukovoditel 2.5.2, where SQL injection arises from improper handling of the reports_id POST parameter. The vulnerability enables manipulation of SQL queries via user-supplied input, with CVSS indicating high to critical impact (CVSS v2 base 7.5; CVSS v3.1 base 9.8). Exploit...

CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

CVE-2020-11812

CVE-2020-11812 affects Rukovoditel 2.5.2. The vulnerability is an SQL injection stemming from improper handling of the filters[0][value] and filters[1][value] parameters in the web application. Public sources in the connected documents confirm the technical issue but do not provide a vendor-issue...

CVE-2020-11813

CVE-2020-11813: In Rukovoditel 2.5.2, a stored XSS exists on the configuration page via the copyright text input, causing injected scripts to potentially steal user data since the copyright text appears on every page. The vulnerability is triggered by unsanitized input in a client-side field; doc...