RULE(RULE ID:333592)

Rule General Information
Release Date: 2021-05-20
Rule Name: Weaver e-cology V9 Arbitrary File Upload Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Weaver e-cology is an Office Automation (OA) software developed by Weaver Software, a Chinese company. The software aims to provide an integrated solution for internal office processes within enterprises, enhancing office efficiency and information management.Weaver e-cology V9 has a vulnerability that allows arbitrary file upload, loophole URL is/weaver/weaver.com mon. Ctrl/CSS. Enabling malicious attackers to upload files to the server through the uploaderOperate method and gain control over it.
Impact: An attacker could exploit this vulnerability to upload webshell file,then control the server.
Affected OS: Windows, Linux, Others
Reference:
Solutions
The vendors have released upgrade patches to fix vulnerabilities, please visit:
https://www.weaver.com.cn/cs/securityDownload.html#