Zsadmin2025
Monthly
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.
SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderField parameter in the department pagination API. The vulnerable sorting functions OrderItem.asc and OrderItem.desc in SysDeptController accept unsanitized input and construct ORDER BY clauses through string concatenation, enabling injection against all instances up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. A public exploit has been disclosed through the project's own GitHub issue tracker, and no vendor response or patch has been issued at time of analysis.
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.
SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderField parameter in the department pagination API. The vulnerable sorting functions OrderItem.asc and OrderItem.desc in SysDeptController accept unsanitized input and construct ORDER BY clauses through string concatenation, enabling injection against all instances up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. A public exploit has been disclosed through the project's own GitHub issue tracker, and no vendor response or patch has been issued at time of analysis.