An unauthenticated remote code execution flaw in Red Sea Cloud eHR allows attackers to compromise the system through malicious file uploads, with evidence of active exploitation in the wild.

The application lacks proper MIME type and extension validation in the PtFjk.mob servlet. Attackers can bypass security checks by spoofing the Content-Type header to upload and execute JSP webshells.

The CVSS score of 9.8 highlights the critical nature of this flaw, which provides a direct path to total system takeover. Business consequences include the potential for unauthorized access to sensitive employee HR data, loss of system integrity, and significant operational disruption due to attacker-controlled webshells.

Immediate Action: Apply the latest security update from Guangzhou Red Sea Cloud Computing Co. immediately, as the vulnerability is currently subject to active exploitation.

Proactive Monitoring: Monitor the /uploadfile/ directory for unexpected file creations and audit web server access logs for anomalous requests to the PtFjk.mob endpoint.

Compensating Controls: Implement WAF filtering to restrict file uploads to legitimate types and block requests that attempt to bypass extension validation.

Public Exploit Available: Not specified

Immediate remediation is required to protect the integrity of the eHR environment. Organizations should verify that their instances are patched and perform a forensic review of system logs to ensure that no unauthorized persistence mechanisms have been established by attackers prior to patching.