PT-2025-9695 · Unknown · Hzmanyun Education/Training System
Heihei_Xz
·
Publicado
2025-03-04
·
Atualizado
2026-01-29
·
CVE-2025-1947
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
hzmanyun Education and Training System version 2.1.3
Description
A critical vulnerability has been found in the hzmanyun Education and Training System. This affects the
scorm function of the UploadImageController.java file. The manipulation of the param argument leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.Recommendations
For hzmanyun Education and Training System version 2.1.3, as a temporary workaround, consider disabling the
scorm function of the UploadImageController.java file until a patch is available. Restrict access to the UploadImageController.java file to minimize the risk of exploitation. Avoid using the param argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Command Injection
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hzmanyun Education/Training System