RULE(RULE ID:338746)

Rule General Information
Release Date: 2025-03-19
Rule Name: Yonyou GRP U8 FileUpload Arbitrary File Upload Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Yonyou GRP-U8 Administrative and Public Financial Management Software is a new generation product launched by Yonyou Corporation, focusing on the national electronic government affairs sector. It is the most professional government financial management software in China's administrative and financial field, based on cloud computing technology. The FileUpload endpoint contains an arbitrary file upload vulnerability. Attackers can exploit this vulnerability to upload malicious files to the server, enabling them to execute arbitrary code on the server and gain control over the target system.
Impact: Attackers can upload viruses, Trojans, WebShell, other malicious scripts or pictures containing scripts to the server, and attackers can use these files for subsequent attacks.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.