CyberRota Analysis
AI-GeneratedVersions 1.19 and earlier of WebErpMesv2 are vulnerable to unauthenticated remote code execution due to improper handling of file uploads, allowing self-registered users to upload arbitrary PHP files. This critical vulnerability arises from open registration and inadequate role management, posing a significant risk to any default installation. Organizations using this system should prioritize applying the patch to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.