Design/Logic Flaw

2024-02-0616:15:00

PRIOn knowledge base

www.prio-n.com

design flaw

logic flaw

file upload

arbitrary

nvd

controllable paths

security vulnerability

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.1%

JSON

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.