The flaw resides in the com.sksoft.bill.ImageUpload servlet of Yonyou KSOA 9.0. It accepts unauthenticated POST requests containing attacker‑controlled filepath and filename values without performing authentication or validating the file type, extension, or content. By uploading a specially named JSP file to the pictures directory, an attacker can place a webshell in a web‑accessible location and have it executed by the application’s servlet container, giving the attacker unrestricted code execution. This corresponds to CWE‑434, an arbitrary file upload vulnerability.

The issue is specific to Yonyou Network Technology Co., Ltd.’s KSOA 9.0 application. No other editions or versions are mentioned as affected, but any deployment that still includes the vulnerable ImageUpload servlet remains at risk.

The CVSS score of the lack of authentication means any host exposed to the ImageUpload endpoint can be targeted without initial access. The EPSS score of < 1% indicates a low probability of observed exploitation in the wild is already documented and used in the field; the Shadowserver Foundation observed an exploit on 2023‑11‑07. The attack path is straightforward: an unauthenticated attacker issues a crafted POST request to /ImageUpload, points the filepath to the web root, uploads a JSP shell, and immediately gains remote code execution. The vulnerability is not listed in the CISA KEV catalog, but its critical nature warrants immediate remediation.