CVE-2025-66744
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ufida | yonbip | 2024930 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal flaw in the Yonyou YonBIP system, specifically in the LoginWithV8 interface. It occurs because the system improperly handles input containing directory traversal sequences like "../", allowing attackers to access files outside the intended directory. By exploiting this, an attacker can read arbitrary files on the server, including sensitive system files and administrative tokens, without authorization. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive information stored on the server, such as system configuration files and administrative tokens. This exposure can compromise the security of the affected system, potentially allowing attackers to gain further access or control, leading to data breaches or system compromise. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted GET requests to the vulnerable interface to check for path traversal. For example, you can use curl commands to test if the system improperly handles directory traversal sequences. A sample command is: curl -v "http://<target>/bi/api/Portal/LoginWithV8/?ticket=/../../../../Windows/win.ini" which attempts to access the win.ini file. Another test is: curl -v "http://<target>/bi/api/Portal/LoginWithV8/?ticket=admin" to check if sensitive tokens or administrative information are exposed. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable interface, implementing input validation to sanitize and block directory traversal sequences such as '../' in the ticket parameter, and applying any available patches or updates from the vendor that address this vulnerability. Additionally, monitoring and blocking suspicious requests targeting the /bi/api/Portal/LoginWithV8/ endpoint can help reduce exploitation risk. [1]