A critical remote code execution vulnerability in SMEWebify WebErpMesv2 allows unauthenticated attackers to execute arbitrary PHP code on the host server.

The application fails to perform adequate input validation and authentication checks on the HR Expense scan_file parameter, allowing unauthenticated users to upload malicious PHP files. This is exacerbated by broken role middleware and open registration, enabling full system compromise.

Successful exploitation allows an unauthenticated attacker to gain full control over the application server. This leads to complete data compromise, unauthorized access to sensitive manufacturing data, and potential lateral movement into the internal network. Given the CVSS score of 9.8, this vulnerability represents an immediate and extreme risk to organizational security.

Immediate Action: Upgrade to the latest version of SMEWebify WebErpMesv2 immediately, ensuring the fix provided in commit 5c54862fa044b363fd2be03d586750e81afd6818 is applied.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the HR Expense module and monitor for unexpected file creation in the upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload requests containing suspicious extensions, such as .php, to mitigate the risk until the software can be patched.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk due to the ease of exploitation and the level of access granted to an attacker. Administrators must prioritize the application of the provided security patch immediately. If an immediate upgrade is not possible, the affected HR Expense functionality should be disabled or restricted at the network level until remediation is complete.