PT-2025-39809 · Unknown · Bjskzy Zhiyou Erp

Nu11 · Published 2025-09-29 · Updated 2025-10-04 · CVE-2025-11140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0

Description A flaw exists in Bjskzy Zhiyou ERP that could allow for remote manipulation. The issue is related to the openForm function within the com.artery.richclient.RichClientService component. Specifically, manipulating the contentString argument can lead to xml external entity reference. The exploit is publicly available.

Recommendations Update to a version of Bjskzy Zhiyou ERP greater than 11.0. As a temporary workaround, consider restricting access to the openForm function until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2025-11140

Affected Products

Bjskzy Zhiyou Erp

References · 10

• 🔥 https://github.com/FightingLzn9/vul/blob/main/%E6%97%B6%E7%A9%BA%E6%99%BA%E5%8F%8Berp-3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11140 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11140 · Vendor Advisory
• https://twitter.com/cracbot/status/1974429333302174170 · Twitter Post
• https://twitter.com/CVEnew/status/1972522824721129751 · Twitter Post
• https://t.me/CVEtracker/33610 · Telegram Post
• https://vuldb.com/?ctiid.326217 · Note
• https://vuldb.com/?submit.658090 · Note
• https://vuldb.com/?id.326217 · Note
• https://t.me/cveNotify/136769 · Telegram Post