Seeyon Zhiyuan OA System Path Traversal File Upload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 1 proof of concept on GitHub, 1 Nuclei template
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Public exploit on Exploit-DB
EDB-52490
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) Zhiyuan OA Web Application System
From 5.1 · through 5.6sp1; From 6.0 · through 6.1sp2; From 7.0sp1 · through 7.1; From 8.0 · through 8.0sp2