Volerion logoVolerion
Volerion logoVolerion

WukongCRM Arbitrary File Upload Vulnerability in Image Update Component Allowing Code Execution

Vulnerability

A vulnerability allowing arbitrary file upload has been identified in WukongCRM-11.0-JAVA versions prior to 11.3.3. This vulnerability exists in the image update component located at /adminUser/updateImg. Attackers can exploit this issue by uploading a crafted file, which could lead to the execution of arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where WukongCRM is running.

Reproduction

To reproduce this vulnerability, upload a crafted file through the /adminUser/updateImg component. The file must be designed to exploit the arbitrary file upload vulnerability, potentially allowing for code execution on the server.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
10.0
exploitability
7.7
remediation
0.0
relevance
0.0
threat
6.4
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.