CVE-2024-24000 : faille critique huaxiaerp jsherp (CVSS 9.8)

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.

Sévérité

Critique (CVSS 9.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

6 févr. 2024

Dernière mise à jour

17 juin 2026

• huaxiaerp jsherp

• Fiche CVE-2024-24000 sur le NVD (NIST)
• github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcx…
• github.com/jishenghua/jshERP