Description

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T05:16:55.387Z",
  "pubdate": "2026-09-07T05:16:55.387Z",
  "executiveSummary": "This vulnerability is an unrestricted file upload flaw identified in Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000.\nThe vulnerability resides within the /Report/Upload/UploadFormImg.ashx handler, which fails to adequately validate the characteristics of user-supplied files.\nSuccessful exploitation allows a remote, unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution (RCE) if the uploaded file is processed or executed by the web server.\nThe risk is critical as the exploit is publicly disclosed and accessible, providing a straightforward pathway for attackers to compromise the integrity and availability of the affected system.\nThe vulnerability is remotely exploitable, requiring no prior authentication or administrative privileges to initiate the attack vector.",
  "technicalDetails": "The vulnerability exists in the /Report/Upload/UploadFormImg.ashx file of the Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000 application.\nThe root cause is an improper implementation of server-side file type and content validation mechanisms within the file upload functionality. Specifically, the application fails to enforce restrictive allow-lists for file extensions, MIME types, or content headers for the 'File' argument.\nThe attack flow begins with the adversary targeting the /Report/Upload/UploadFormImg.ashx endpoint. By manipulating the 'File' parameter in an HTTP POST request, an attacker can bypass intended security controls to transmit arbitrary binary data.\nBecause the application does not strictly sanitize the input or validate the underlying file structure, it allows for the storage of malicious files, such as web shells or scripts, within the server's directory structure. If the application environment is configured to interpret scripts (e.g., .aspx or .ashx files) within the upload directory, the attacker can execute arbitrary code with the permissions of the web application process.\nThis vulnerability is remotely accessible over the network. The lack of authentication requirements at the /Report/Upload/UploadFormImg.ashx endpoint means that any remote user can interact with the upload handler, significantly increasing the attack surface.\nPost-exploitation impacts include full system compromise, unauthorized access to sensitive application data, potential lateral movement within the hosting environment, and the establishment of persistent backdoors. The public disclosure of the exploit code exacerbates the situation by lowering the technical barrier for potential attackers to weaponize this flaw against production environments."
}