CVE-2025-11139
📋 TL;DR
This is a path traversal vulnerability in Bjskzy Zhiyou ERP that allows attackers to manipulate file paths in the uploadStudioFile function. Remote exploitation could enable unauthorized file access or upload. Affected systems include all installations up to version 11.0.
💻 Affected Systems
- Bjskzy Zhiyou ERP
📦 What is this software?
Zhiyou Erp by Zhiyou Group
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains arbitrary file read/write access, potentially leading to system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file access leading to sensitive information disclosure or limited file manipulation.
If Mitigated
Attack blocked at network perimeter or application firewall, no impact on protected systems.
🎯 Exploit Status
Exploit details are publicly available in GitHub repository. Remote exploitation is confirmed possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to version 11.1 or later if available.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to block path traversal sequences in filepath parameter
Implement regex filter: /(\.\.\/|\.\.\\)/
Web Application Firewall
allDeploy WAF rules to block path traversal patterns
Configure WAF to block requests containing '../' or '..\' patterns
🧯 If You Can't Patch
- Isolate affected systems from internet access
- Implement strict network segmentation and monitor for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check ERP version number in application interface or configuration filesCheck Version:
Check application version in web interface or config filesVerify Fix Applied:
Test upload functionality with path traversal payloads to confirm blocking📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or '..\' in filepath parameter
- Unusual file access patterns from web application
Network Indicators:
- HTTP POST requests to uploadStudioFile endpoint with suspicious parameters
SIEM Query:
web.url:*uploadStudioFile* AND (web.param:*../* OR web.param:*..\*)