PT-2026-55262 · Yonyou · Ksoa

Published 2026-07-02 · Updated 2026-07-02 · CVE-2022-50973

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0

Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without authentication or validation of file type, extension, or content. By specifying a malicious filename and root filepath, an attacker can upload a JSP webshell to the pictures directory, which the web server then executes, leading to remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-50973

Affected Products

Ksoa

References · 8

• 🔥 https://buaq.net/go-167023.html · Exploit
• 🔥 https://cnblogs.com/yang-miemie/p/17714927.html · Exploit
• 🔥 https://cn-sec.com/archives/1329088.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50973 · Security Note
• https://vulncheck.com/advisories/yonyou-ksoa-unauthenticated-file-upload-rce-via-imageupload-servlet · Note
• https://yonyou.com · Note
• https://twitter.com/CVEnew/status/2072756734020456602 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072757507332694078 · Twitter Post