RULE(RULE ID:338240)

Rule General Information
Release Date: 2024-07-09
Rule Name: SHIKONGZHIYOU ERP updater.uploadStudioFile Arbitrary File Upload Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: SHIKONGZHIYOU ERP is an integrated enterprise resource planning system focused on delivering comprehensive business process management to enhance operational efficiency and decision support for businesses. The updater.uploadStudioFile interface of SHIKONGZHIYOU ERP has an arbitrary file upload vulnerability, which malicious attackers can exploit to upload malicious software such as backdoors, Trojans, or ransomware to gain remote access to the server or to compromise the system, posing a significant security risk to the server.
Impact: Attackers can upload viruses, Trojans, WebShell, other malicious scripts or pictures containing scripts to the server, and attackers can use these files for subsequent attacks.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.