CVE-2025-34163 (CNNVD-202508-3160)
中文标题:
Dongsheng Logistics Software 安全漏洞
英文标题:
Dongsheng Logistics Software Unauthenticated Arbitrary File Upload
漏洞描述
中文描述:
Dongsheng Logistics Software是中国东胜（Dongsheng）公司的一款物流管理系统。 Dongsheng Logistics Software存在安全漏洞，该漏洞源于/CommMng/Print/UploadMailFile端点未验证文件类型，可能导致远程代码执行。
英文描述:
Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST request. This allows remote code execution on the server, potentially leading to full system compromise. The vulnerability is presumed to affect builds released prior to July 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-23 UTC.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Qingdao Dongsheng Weiye Software Co., Ltd. | Dongsheng Logistics Software | - | ≤ pre-July 2025 builds | - |
cpe:2.3:a:qingdao_dongsheng_weiye_software_co.,_ltd.:dongsheng_logistics_software:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-34163 |
2025-11-11 15:23:17 | 2025-11-11 07:40:25 |
| NVD | nvd_CVE-2025-34163 |
2025-11-11 15:01:00 | 2025-11-11 07:48:15 |
| CNNVD | cnnvd_CNNVD-202508-3160 |
2025-11-11 15:12:55 | 2025-11-11 08:00:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-3160
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']