Seeyon Zhiyuan OA Web Application Salary Module Beetl Template Code Injection Vulnerability
Vulnerability
A critical code injection vulnerability has been identified in the Seeyon Zhiyuan OA Web Application System version 8.1 SP2. The issue arises in the Beetl Template Handler, specifically within the postData function of the EhrSalaryPayrollServiceImpl class. The vulnerability allows for remote arbitrary command execution by manipulating the payrollId argument.
Impact
Exploitation of this vulnerability allows for remote arbitrary command execution on the server where the application is running.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
5.0remediation
0.0relevance
0.0threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.