critical9.8
CVE-2024-24000
jshERP v3.3 is vulnerable to Arbitrary File Upload.
Impact
jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Huaxiaerp | Jsherp | Version 3.3 |