VulnSocial

CVE-2022-50973Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 2 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-02); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-07-02: 2Mentions · 2026-07-03: 2Active Exploitation · 2026-07-03: 2Patch / Workaround · 2026-07-03: 1Technical Details · 2026-07-02: 2Technical Details · 2026-07-03: 207-0207-03
Signal classification2 categories
Disclosure
250.0%
Active Exploitation
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-022
Disclosure2
2026-07-032
Active Exploitation2
Full discourse4 posts
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs
    Active Exploitation

    CVE-2022-50973 Yonyou KSOA ERP Tier 1: unauthenticated file upload lets attackers deploy webshells and execute code on internet-facing ERP systems, with confirmed in-the-wild exploitation Full Analysis https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-07-02/TIER_1_CVE-2022-50973.md #CyberSecurity #VulnerabilityManagement #CyberRisk

    Post summary

    CVE-2022-50973 is actively exploited via an unauthenticated file upload flaw that allows attackers to deploy webshells and execute code on Yonyou KSOA ERP systems; a detailed analysis is available in the linked report.

    0000038
    56 followersView on X
  • Upwind Security MDR@UpwindMDR
    Active Exploitation

    🚨Critical - Yonyou KSOA Unauthenticated File Upload RCE (CVE-2022-50973) Yonyou KSOA 9.0's com.sksoft.bill.ImageUpload servlet accepts POST requests with attacker-controlled filepath and filename parameters - with no authentication and no file type, extension, or content validation. An unauthenticated attacker can upload a JSP webshell by supplying a malicious filename and root filepath. The uploaded file lands under the pictures directory and is executed directly by the web server, giving unauthenticated remote code execution. Exploitation has been observed in the wild since November 2023 (Shadowserver), and CISA rates it as automatable. 👉Affected: Yonyou KSOA 9.0 - apply vendor guidance / restrict access to the ImageUpload servlet.

    Post summary

    CVE‑2022‑50973 is a critical unauthenticated remote‑code‑execution flaw in Yonyou KSOA caused by unvalidated file uploads. Active exploitation has been reported in the wild, and vendor guidance has been issued.

    0000063
    236 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2022-50973 Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to up… https://www.cve.org/CVERecord?id=CVE-2022-50973 ----- Traducción: CVE-2022-50973 Yon… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2022‑50973 as an unauthenticated arbitrary file upload vulnerability in Yonyou KSOA 9.0, without presenting a PoC, exploit, patch, or active exploitation evidence.

    0000030
    91 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2022-50973 Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to up… https://www.cve.org/CVERecord?id=CVE-2022-50973

    Post summary

    The post announces CVE-2022-50973 as an unauthenticated arbitrary file upload flaw in Yonyou KSOA 9.0, without any mention of PoC, exploitation, or patch.

    00000653
    57.7K followersView on X

Explore more

Back to dashboard