This critical vulnerability allows unauthenticated remote code execution on Weaver E-cology 9.0 servers via arbitrary file uploads.

The application fails to properly validate file uploads within the uploaderOperate.jsp component. An unauthenticated attacker can submit a multipart/form-data POST request to upload JSP webshells, resulting in full system compromise under the application server process privileges.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it permits total system takeover without requiring any user credentials. Successful exploitation could lead to full data exfiltration, complete loss of system integrity, and significant operational downtime, posing a severe risk to organizational security and business continuity.

Immediate Action: Update Weaver E-cology 9.0 to version 10.52 or later immediately to resolve the vulnerable file upload logic.

Proactive Monitoring: Review web access logs for unusual POST requests directed at /workrelate/plan/util/uploaderOperate.jsp and monitor server directories for unauthorized JSP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block multipart/form-data requests containing suspicious file extensions or unauthorized patterns targeting the affected path.

Public Exploit Available: Yes — multiple public proof-of-concept repositories and technical write-ups exist.

Given the critical severity and the existence of public proof-of-concept code, organizations must prioritize patching this vulnerability immediately. Failure to apply the vendor-provided update exposes the application to trivial exploitation and potential full system compromise.