Zhiyuan OA - arbitrary file upload leading
Zhiyuan OA - arbitrary file upload leading
AI Analysis
Technical Summary
The vulnerability in Zhiyuan OA (CVE-2025-34040) arises from improper validation of multipart file upload parameters in the wpsAssistServlet component. Specifically, the realFileType parameter is used to resolve the target file path without sufficient sanitization, allowing path traversal sequences (e.g., '..') to write files outside the intended directory. An attacker can upload a crafted JSP file to the web application root, enabling remote code execution upon access. This flaw affects versions 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, and 8.0–8.0sp2. The exploit requires sending a multipart/form-data POST request to the vulnerable servlet with manipulated parameters. The vendor has issued patch information on their site, but patch availability is not explicitly confirmed in the provided data.
Potential Impact
Successful exploitation results in remote code execution on the affected server, potentially leading to complete server compromise. Attackers can execute arbitrary code, persist on the system, exfiltrate data, and pivot to internal networks. This represents a significant risk to confidentiality, integrity, and availability of the affected systems.
Mitigation Recommendations
The vendor has published patch information at https://service.seeyon.com/patchtools/tp.html. Users should consult the vendor advisory to confirm patch availability and apply official fixes promptly. Until patched, restrict access to the wpsAssistServlet endpoint and monitor for suspicious file uploads if possible. Patch status is not explicitly confirmed in this data; therefore, verify current remediation guidance from the vendor advisory before taking action.
Indicators of Compromise
- exploit-code: # Exploit Title: Zhiyuan OA - arbitrary file upload leading # Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2" # Date: 1-11-2025 # Exploit Author: Beatriz Fresno Naumova # Vendor Homepage: https://service.seeyon.com/ # Software Link: [vendor download / product page if available] # Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck) # Tested on: MacOS # CVE: CVE-2025-34040 Description: A path-traversal / improper validation in the multipart file upload handling of Zhiyuan OA's `wpsAssistServlet` allows an unauthenticated actor (or actor able to reach upload endpoint) to place crafted files outside the intended directories by controlling `realFileType` and `fileId` parameters. Under affected configurations, an uploaded JSP can be stored in the webroot and executed, yielding remote code execution. High-level reproduction template (redacted — non-actionable): POST request to `/seeyon/wpsAssistServlet` with multipart/form-data. The `realFileType` parameter is used to resolve the target path; insufficient validation permits `..` sequences leading to writes under webapp root. The uploaded file contents must be controlled to produce a server-side executable file (e.g., JSP) — DO NOT include such server-side code here. Impact: - Remote code execution if the uploaded file is accessible and executable. - Complete server compromise and pivoting to internal networks. - Data exfiltration, persistence, and further lateral movement. References: - NVD CVE-2025-34040 (NVD entry – awaiting enrichment) - VulnCheck advisory: https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload - CNVD entry: https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627 - Vendor patch/notice: https://service.seeyon.com/patchtools/tp.html POC; POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/Hello.jsp&fileId=2 HTTP/1.1 Host: Content-Type: multipart/form-data; boundary=...... Accept-Encoding: gzip --...... Content-Disposition: form-data; name="upload"; filename="123.xls" Content-Type: application/vnd.ms-excel <% out.println("HelloWorld");%> --.......--
Zhiyuan OA - arbitrary file upload leading
Description
Zhiyuan OA - arbitrary file upload leading
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Zhiyuan OA (CVE-2025-34040) arises from improper validation of multipart file upload parameters in the wpsAssistServlet component. Specifically, the realFileType parameter is used to resolve the target file path without sufficient sanitization, allowing path traversal sequences (e.g., '..') to write files outside the intended directory. An attacker can upload a crafted JSP file to the web application root, enabling remote code execution upon access. This flaw affects versions 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, and 8.0–8.0sp2. The exploit requires sending a multipart/form-data POST request to the vulnerable servlet with manipulated parameters. The vendor has issued patch information on their site, but patch availability is not explicitly confirmed in the provided data.
Potential Impact
Successful exploitation results in remote code execution on the affected server, potentially leading to complete server compromise. Attackers can execute arbitrary code, persist on the system, exfiltrate data, and pivot to internal networks. This represents a significant risk to confidentiality, integrity, and availability of the affected systems.
Mitigation Recommendations
The vendor has published patch information at https://service.seeyon.com/patchtools/tp.html. Users should consult the vendor advisory to confirm patch availability and apply official fixes promptly. Until patched, restrict access to the wpsAssistServlet endpoint and monitor for suspicious file uploads if possible. Patch status is not explicitly confirmed in this data; therefore, verify current remediation guidance from the vendor advisory before taking action.
Technical Details
- Edb Id
- 52490
- Has Exploit Code
- true
- Code Language
- text
Indicators of Compromise
Exploit Source Code
Exploit code for Zhiyuan OA - arbitrary file upload leading
# Exploit Title: Zhiyuan OA - arbitrary file upload leading # Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2" # Date: 1-11-2025 # Exploit Author: Beatriz Fresno Naumova # Vendor Homepage: https://service.seeyon.com/ # Software Link: [vendor download / product page if available] # Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck) # Tested on: MacOS # CVE: CVE-2025-34040 Description: A path-traversal / improper validation in the multipart file upload handling... (1646 more characters)
Threat ID: 69d4e432aaed68159a0d4594
Added to database: 4/7/2026, 11:02:10 AM
Last enriched: 4/7/2026, 11:02:57 AM
Last updated: 4/7/2026, 5:38:41 PM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.