PT-2025-27333

CVE-2025-6829

Published

2025-06-28

Updated

2025-11-24

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207

Description: A critical issue was found in the outAddress function of the External Address Book Handler component, leading to SQL injection. The attack can be initiated remotely.

Recommendations: For aaluoxiang oa system up to c3a08168c144f27256a90838492c713f55f1b207, as a temporary workaround, consider disabling the outAddress function of the External Address Book Handler component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-99: Improper Control of Resource Identifiers (\'Resource Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2025-6829