CVE-2025-34040
CRITICAL EXPLOITED NUCLEIZhiyuan OA Web Application System - Unauthenticated Arbitrary File Upload and Remote Code Execution via wpsAssistServlet
Title source: llmExploitation Summary
CVE-2025-34040 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Beatriz Fresno Naumova, jisi-001. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates a path traversal vulnerability in Zhiyuan OA's `wpsAssistServlet` allowing unauthenticated arbitrary file upload. By manipulating the `realFileType` parameter, an attacker can place a JSP file in the webroot, leading to remote code execution.
Description
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Exploits (2)
The exploit demonstrates a path traversal vulnerability in Zhiyuan OA's `wpsAssistServlet` allowing unauthenticated arbitrary file upload. By manipulating the `realFileType` parameter, an attacker can place a JSP file in the webroot, leading to remote code execution.
This repository contains a Python-based exploit for CVE-2025-34040, targeting a file upload vulnerability in ZhiYuan OA that leads to RCE. The PoC constructs a malicious multipart/form-data request to upload a JSP file to a predictable path, then verifies its presence via HTTP GET.
Nuclei Templates (1)
body="seeyon/index.jsp"
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H