PT-2024-30101 · Huizhi · Huizhi

Published 2024-08-15 · Updated 2024-11-18 · CVE-2024-42676

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huizhi enterprise resource management system versions 1.0 and before

Description The issue allows a remote attacker to execute arbitrary code via the "/nssys/common/Upload.aspx?Action=DNPageAjaxPostBack" component. This is a File Upload vulnerability, which can lead to severe data exposure.

Recommendations For Huizhi enterprise resource management system versions 1.0 and before, patch immediately and review uploaded files for malware. Limit file upload permissions to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the "/nssys/common/Upload.aspx" endpoint until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-42676

Affected Products

Huizhi

References · 11

• 🔥 https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-42676.md · Exploit
• 🔥 https://github.com/WarmBrew/web_vul/blob/main/HZ-cve/HZupload.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-42676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42676 · Security Note
• https://twitter.com/oktsec/status/1825295180653621624 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1824125019846238377 · Twitter Post
• https://t.me/cvenotify/102040 · Telegram Post
• https://t.me/cvenotify/90754 · Telegram Post
• https://twitter.com/CVEnew/status/1824087119070966188 · Twitter Post
• https://twitter.com/cracbot/status/1825774849811427478 · Twitter Post
• https://t.me/cvedetector/3242 · Telegram Post