CVE-2025-34040 PoC — Seeyon Zhiyuan OA System Path Traversal File Upload

Source

https://github.com/jisi-001/CVE-2025-34040Exp

Associated Vulnerability

Title:Seeyon Zhiyuan OA System Path Traversal File Upload (CVE-2025-34040)
Description:An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.

Description

致远OA存在文件上传导致RCE（CVE-2025-34040）

Readme

# 致远OA存在文件上传导致RCE（CVE-2025-34040）

参数

```
options:
  -h, --help            show this help message and exit
  -u URL, --url URL     请输入待检测的URL
  -f FILE, --file FILE  请输入一行一个URL的文件地址
  -n FILENAME, --filename FILENAME
                        请输入文件名（默认为Hello.jsp）：
  -c CONTENT, --content CONTENT
                        请输入上传的文件内容（默认为HelloWord）：
```

样例

```
单URL检测：
python .\CVE-2025-34040Exp.py -u URL
批量检测：
python .\CVE-2025-34040Exp.py -f urls.txt
指定上传文件名：
python .\CVE-2025-34040Exp.py -u URL -n Hello.jsp
指向上传文件内容：
python .\CVE-2025-34040Exp.py -u URL -n Hello.jsp -c '<% out.println("123");%>'
```

File Snapshot


 [4.0K]  /data/pocs/ce943860d91633331b1ede16d5985b48706a07b3
├── [3.1K]  CVE-2025-34040Exp.py
└── [ 784]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!