RULE(RULE ID:338170)

Rule General Information
Release Date: 2024-06-25
Rule Name: Landray EIS api.aspx Arbitrary File Upload Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Landray EIS is a comprehensive enterprise management software, with knowledge management as the core, committed to improving organizational productivity. Landray EIS has an arbitrary file upload vulnerability. This vulnerability is due to the fact that the api.aspx interface does not filter the files uploaded by users, so that malicious attackers can upload arbitrary files to the server through this vulnerability, such as backdoors, Trojans or ransomware, to obtain remote access to the server or damage the system.
Impact: Attackers can upload viruses, Trojans, WebShell, other malicious scripts or pictures containing scripts to the server, and attackers can use these files for subsequent attacks.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.