jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.
History

Thu, 12 Jun 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-06-12T14:40:17.447Z

Reserved: 2024-01-25T00:00:00.000Z

Link: CVE-2024-24000

cve-icon Vulnrichment

Updated: 2024-08-01T23:13:08.566Z

cve-icon NVD

Status : Modified

Published: 2024-02-06T16:15:52.317

Modified: 2025-06-12T15:15:35.663

Link: CVE-2024-24000

cve-icon Redhat

No data.