CVE-2025-3562 in YonBIP
Summary
by MITRE • 04/14/2025
A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the file /mobsm/common/userfile. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability in Yonyou YonBIP MA2.7 represents a critical path traversal flaw that directly impacts the file system security of the application. The issue manifests within the FileInputStream function located at /mobsm/common/userfile, where improper validation of the path argument creates an exploitable condition that allows attackers to access arbitrary files on the server. This vulnerability is classified as CWE-22 Path Traversal and falls under the broader category of directory traversal attacks that have been documented in numerous security frameworks including the Common Vulnerabilities and Exposures database. The flaw operates by accepting user-controllable input without proper sanitization, enabling malicious actors to manipulate file paths through specially crafted requests that can traverse directory structures beyond intended boundaries.
The remote exploitation capability of this vulnerability significantly increases its threat level, as attackers do not require physical access to the system or local network privileges to exploit the flaw. Attackers can leverage this vulnerability to access sensitive files including configuration data, database credentials, application source code, and potentially user information stored within the application's file system. The public disclosure of the exploit means that threat actors can readily utilize this knowledge without requiring advanced technical skills or extensive reconnaissance. This type of vulnerability directly aligns with ATT&CK technique T1083 File and Directory Discovery, where adversaries systematically enumerate system resources to identify valuable targets for further exploitation.
The operational impact of this vulnerability extends beyond simple data theft, as successful exploitation can lead to complete system compromise through additional attack vectors that may follow the initial path traversal. Organizations running affected Yonyou YonBIP MA2.7 installations face potential exposure to data breaches, regulatory compliance violations, and significant financial losses due to unauthorized access to corporate information. The lack of vendor response to early disclosure attempts compounds the risk, as organizations cannot rely on official patches or updates to address the vulnerability. This scenario represents a classic case of an unpatched security flaw in enterprise software where the vendor's delayed response creates an extended window of exposure for affected organizations.
Mitigation strategies should include immediate implementation of input validation controls that sanitize all user-supplied path arguments, deployment of web application firewalls with path traversal detection capabilities, and network segmentation to limit access to vulnerable components. Organizations should also conduct comprehensive file system audits to identify and restrict access to sensitive files, while implementing proper access controls using principles of least privilege. The remediation process must include thorough code review of the FileInputStream function in /mobsm/common/userfile, along with implementation of secure coding practices that prevent path traversal vulnerabilities. Additionally, organizations should consider deploying intrusion detection systems capable of identifying suspicious file access patterns and establishing incident response procedures specifically designed to address path traversal attacks. The vulnerability serves as a reminder of the critical importance of timely vendor communication and proactive security measures in protecting enterprise applications from publicly disclosed exploits that can be readily weaponized by threat actors.