PT-2025-9695 · Unknown · Hzmanyun Education/Training System
Heihei_Xz
·
Published
2025-03-04
·
Updated
2026-01-29
·
CVE-2025-1947
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
hzmanyun Education and Training System version 2.1.3
Description
A critical vulnerability has been found in the hzmanyun Education and Training System. This affects the
scorm function of the UploadImageController.java file. The manipulation of the param argument leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.Recommendations
For hzmanyun Education and Training System version 2.1.3, as a temporary workaround, consider disabling the
scorm function of the UploadImageController.java file until a patch is available. Restrict access to the UploadImageController.java file to minimize the risk of exploitation. Avoid using the param argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Command Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hzmanyun Education/Training System