PT-2025-6121 · Lumsoft · Lumsoft Erp

0Xgeoffreyw · Published 2025-02-11 · Updated 2025-02-16 · CVE-2025-1165

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Lumsoft ERP version 8

Description: A critical issue was found in the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations: For Lumsoft ERP version 8, consider disabling the DoUpload/DoWebUpload function in the /Api/FileUploadApi.ashx file as a temporary workaround until a patch is available. Restrict access to the /Api/FileUploadApi.ashx file to minimize the risk of exploitation. Avoid using the file argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-1165

Affected Products

Lumsoft Erp

References · 11

• 🔥 https://github.com/Rain1er/report/blob/main/Lserp/fileUpload_1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1165 · Security Note
• https://twitter.com/CVEnew/status/1889116933695398013 · Twitter Post
• https://vuldb.com/?submit.494516 · Note
• https://github.com/Rain1er/report · Note
• https://twitter.com/cracbot/status/1891080166291698035 · Twitter Post
• https://vuldb.com/?ctiid.295068 · Note
• https://t.me/latest_high_impact_cve/1812 · Telegram Post
• https://vuldb.com/?id.295068 · Note
• https://t.me/cvedetector/17635 · Telegram Post
• https://t.me/cvenotify/110754 · Telegram Post