Dongsheng Logistics Software Unauthenticated Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in Dongsheng Logistics Software prior to July 2025, allowing unauthenticated users to upload arbitrary files, including executable scripts, through a multipart/form-data POST request to the /CommMng/Print/UploadMailFile endpoint. This lack of proper file type validation and access control enables remote code execution on the server, potentially leading to a full system compromise.

Impact

Successful exploitation allows for remote code execution on the server, with the potential for full system compromise.

Remediation

Users are advised to upgrade to the latest version of Dongsheng Logistics Software, as the vulnerability has been addressed in releases after July 2025.