PT-2025-3795 · Tsinghua Unigroup · Tsinghua Unigroup Electronic Archives System

Published 2025-01-05 · Updated 2025-01-05 · CVE-2025-0225

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tsinghua Unigroup Electronic Archives System version 3.2.210802(62532)

Description A problematic vulnerability was found in the Tsinghua Unigroup Electronic Archives System. The issue affects an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the name argument leads to path traversal, allowing an attacker to access files outside the intended directory using '../filedir'. This attack can be launched remotely. The exploit has been publicly disclosed and may be used.

Recommendations For Tsinghua Unigroup Electronic Archives System version 3.2.210802(62532), consider restricting access to the /setting/ClassFy/exampleDownload.html file until a patch is available. As a temporary workaround, avoid using the name argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Relative Path Traversal

Weakness Enumeration

CWE-25

CWE-23

Related Identifiers

CVE-2025-0225

Affected Products

Tsinghua Unigroup Electronic Archives System

References · 10

• 🔥 https://github.com/BxYQ/ld/blob/main/file_read4/poc.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0225 · Security Note
• https://twitter.com/VulmonFeeds/status/1875960606114628004 · Twitter Post
• https://github.com/BxYQ/ld/tree/main/file_read4 · Note
• https://vuldb.com/?id.290215 · Note
• https://vuldb.com/?ctiid.290215 · Note
• https://vuldb.com/?submit.474264 · Note
• https://twitter.com/CVEnew/status/1875953363017167042 · Twitter Post
• https://t.me/cvedetector/14309 · Telegram Post
• https://t.me/cvenotify/106349 · Telegram Post