PT-2024-20995 · Ruvaroa · Ruvaroa

Mr-Xn · Published 2024-05-08 · Updated 2024-07-03 · CVE-2024-25533

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions RuvarOA versions 6.01 through 12.01

Description Error messages in RuvarOA were discovered to leak the physical path of the website, specifically at the /WorkFlow/OfficeFileUpdate.aspx endpoint. This issue can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements.

Recommendations For versions 6.01 through 12.01, consider restricting access to the /WorkFlow/OfficeFileUpdate.aspx endpoint until a patch is available. As a temporary workaround, avoid using crafted SQL statements that could exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-25533

Affected Products

Ruvaroa

References · 7

• 🔥 https://gist.github.com/Mr-xn/bc8261a5c3e35a72768723acf1da358d#information-leakage-and-unauthorized-access-to-sensitive-data · Exploit
• https://osv.dev/vulnerability/CVE-2024-25533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25533 · Security Note
• https://t.me/cvenotify/79665 · Telegram Post
• https://twitter.com/CVEnew/status/1788295912043028968 · Twitter Post
• https://t.me/cvenotify/79673 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1788277048391160138 · Twitter Post