CVE-2024-24000: Unrestricted Upload of File with Dangerous Type

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths...

jshERP Security Vulnerabilities

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP v3.3. The vulnerability stems from the fact that the jshERP-boot/systemConfig/upload interface does not check the uploaded file type and can splice biz...