# CVE-2024-56829: Huang Yaoshi Pharmaceutical Management Software - Arbitrary File Upload

> Live exploitation tracking for CVE-2024-56829 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-56829

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Huang Yaoshi Pharmaceutical Management Software
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** enterprise_software, web_application

## Description

Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.

## CrowdSec analysis

[CVE-2024-56829](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-56829) is a critical arbitrary file upload vulnerability in Huang Yaoshi Pharmaceutical Management Software through version 16.0. Unauthenticated remote attackers can upload files with an `.asp` extension through a SOAP request to `/XSDService.asmx`, potentially placing malicious server-side files on the system and compromising its confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-56829 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/XSDService.asmx` with a crafted SOAP `UploadFile` request to upload arbitrary files. They may then access the uploaded file under `/Upload2015/` to verify it is available.

## Timeline

- 2025-01-02: CVE Published. CVE-2024-56829 is published to NVD.
- 2026-10-27: Rule Released. CrowdSec releases a rule to detect CVE-2024-56829 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-56829 for the first time.

## References

- https://github.com/Zerone0x00/CVE/blob/main/%E9%BB%84%E8%8D%AF%E5%B8%88%E8%8D%AF%E4%B8%9A%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/UploadFile%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56829.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-56829) follows observed exploitation activity for CVE-2024-56829. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.