Suncreate · Suncreate Mountain Flood Disaster Prevention Monitoring/Early Warning System · CVE-2023-3625
**Name of the Vulnerable Software and Affected Versions**
Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706
**Description**
A critical issue was discovered, affecting the /Duty/AjaxHandle/Write/UploadFile.ashx file of the Duty Write-UploadFile component. The manipulation of the `Filedata` argument leads to unrestricted upload. This issue can be exploited remotely.
**Recommendations**
For Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706, as a temporary workaround, consider restricting access to the /Duty/AjaxHandle/Write/UploadFile.ashx file to minimize the risk of exploitation. Avoid using the `Filedata` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.