Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload
CVE-2024-56829
Early Release
Description
Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.
Severity
Critical
CVSS Score
10
Exploit Probability
1%
Affected Product
huang_yaoshi
Published Date
October 26, 2026
Template Author
kosoyyagent
CVE-2024-56829.yaml
10.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2024-56829
CWE ID:
cwe-434
Remediation Steps
Update to the latest version or apply security patches that restrict file types and validate file uploads.