Cyber Posture

CVE-2025-1216

MediumPublic PoC

Published: 12 February 2025

Published
12 February 2025
Modified
26 August 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0009 25.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.

Security Summary

CVE-2025-1216 is a critical SQL injection vulnerability affecting ywoa versions up to 2024.07.03. The flaw resides in the selectNoticeList function within the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml, where the 'sort' argument can be manipulated to inject malicious SQL code. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-12.

The vulnerability enables remote exploitation by an authenticated attacker with low privileges. By crafting a malicious 'sort' parameter, an attacker can execute arbitrary SQL queries, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the affected application's database.

Advisories recommend upgrading to ywoa version 2024.07.04, which addresses the issue. References from VulDB and Gitee indicate the exploit has been publicly disclosed and may be actively used.

The exploit's public availability increases the risk of real-world attacks against unpatched ywoa instances.

Details

CWE(s)
CWE-74CWE-89

Affected Products

r1bbit
yimioa
≤ 2024-07-04

References