PT-2025-16203 · Unknown · Lingxing Erp

207556249

·

Published

2025-04-14

·

Updated

2025-04-25

·

CVE-2025-3551

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Lingxing ERP version 2
Description: A critical issue was found in the function DoUpload of the file /Api/FileUpload.ashx?method=DoUpload. The manipulation of the argument File leads to unrestricted upload. This issue can be exploited remotely.
Recommendations: For Lingxing ERP version 2, as a temporary workaround, consider disabling the DoUpload function of the /Api/FileUpload.ashx?method=DoUpload endpoint until a patch is available. Restrict access to the /Api/FileUpload.ashx?method=DoUpload endpoint to minimize the risk of exploitation. Avoid using the File argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284CWE-434

Related Identifiers

CVE-2025-3551

Affected Products

Lingxing Erp