PT-2025-6860

CVE-2025-1224

Published

2025-02-12

Updated

2025-06-05

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ywoa versions prior to 2024.07.04

Description A critical vulnerability was found in ywoa, affecting the listNameBySql function of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. This vulnerability leads to SQL injection and can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For versions prior to 2024.07.04, upgrade to version 2024.07.04 to address this issue. As a temporary workaround, consider restricting access to the listNameBySql function of the UserMapper.xml file until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Rabbit

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers