Huang Yaoshi Pharmaceutical Management Software - Arbitrary File Upload (CVE-2024-56829)
Description
Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.
psychologyCrowdSec Analysis
CVE-2024-56829 is a critical arbitrary file upload vulnerability in Huang Yaoshi Pharmaceutical Management Software through version 16.0. Unauthenticated remote attackers can upload files with an .asp extension through a SOAP request to /XSDService.asmx, potentially placing malicious server-side files on the system and compromising its confidentiality, integrity, and availability.
CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-56829 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /XSDService.asmx with a crafted SOAP UploadFile request to upload arbitrary files. They may then access the uploaded file under /Upload2015/ to verify it is available.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-01-02 |
| Rule Released | 2026-10-27 |
| CrowdSec First Seen | 2026-10-28 |