Description

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T13:19:10.050Z",
  "pubdate": "2026-08-13T13:19:10.050Z",
  "executiveSummary": "WebErpMesv2 versions 1.19 and prior suffer from an unauthenticated Remote Code Execution vulnerability involving arbitrary file upload.\nThe vulnerability allows any self-registered user to upload malicious PHP files via the HR Expense scan_file parameter.\nCombined with open registration and broken role middleware, specifically CheckUserRole silently swallowing RouteNotFoundException, the vulnerability becomes effectively unauthenticated against default installations.\nSuccessful exploitation grants attackers the ability to execute arbitrary code on the underlying operating system with the privileges of the web server.\nThe inherent risks include complete system compromise, unauthorized access to sensitive manufacturing and resource management data, and potential lateral movement within the network.\nExploitation requirements are minimal, as the attack chain requires no prior authentication or administrative privileges due to flawed access controls and open user registration mechanisms.",
  "technicalDetails": "The vulnerability resides in the HR Expense module of WebErpMesv2, specifically within the handling of the scan_file parameter.\nThe root cause stems from improper input validation and insufficient file type restrictions during the file upload process, allowing the submission and storage of arbitrary PHP files.\nThe affected product is WebErpMesv2 in versions 1.19 and prior, exposing the vulnerable component over network-accessible web interfaces.\nAlthough the application features role-based access control, authentication requirements are effectively bypassed due to broken role middleware. Specifically, the CheckUserRole function silently swallows RouteNotFoundException instances, allowing unauthorized access.\nFurthermore, open registration is enabled by default without requiring an invitation, permitting any external actor to instantly self-register a standard user account.\nThe attack flow proceeds as follows: First, an unauthenticated attacker accesses the open registration endpoint to create a new user account without administrative approval. Second, the attacker leverages the broken role middleware to bypass authorization checks designed to restrict sensitive endpoints. Third, the attacker navigates to the HR Expense functionality and interacts with the vulnerable scan_file parameter.\nBy supplying a specially crafted request containing a malicious PHP payload within the scan_file parameter, the application writes the executable script to the web root or an accessible directory without proper sanitization.\nPost-exploitation impact is severe, as the attacker can directly invoke the uploaded PHP file via standard HTTP requests to execute arbitrary system commands, leading to full Remote Code Execution."
}