CVE-2025-1216
Published: 12 February 2025
Description
A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
Security Summary
CVE-2025-1216 is a critical SQL injection vulnerability affecting ywoa versions up to 2024.07.03. The flaw resides in the selectNoticeList function within the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml, where the 'sort' argument can be manipulated to inject malicious SQL code. Classified under CWE-74 and CWE-89, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-02-12.
The vulnerability enables remote exploitation by an authenticated attacker with low privileges. By crafting a malicious 'sort' parameter, an attacker can execute arbitrary SQL queries, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service within the affected application's database.
Advisories recommend upgrading to ywoa version 2024.07.04, which addresses the issue. References from VulDB and Gitee indicate the exploit has been publicly disclosed and may be actively used.
The exploit's public availability increases the risk of real-world attacks against unpatched ywoa instances.
Details
- CWE(s)