CVE-2025-2216 is a medium severity unrestricted file upload flaw (CVSS 6.3) in zzskzy Warehouse Refinement Management System 1.3. The UploadCrash handler behind /crash/log/SaveCrash.ashx accepts a file without proper checks. No fixed version is named, so restrict access and review uploads.
What's affected
- Product: zzskzy Warehouse Refinement Management System
- Affected version: 1.3
- Vulnerable endpoint:
/crash/log/SaveCrash.ashx, functionUploadCrash, argumentfile - CVSS: 6.3 (Medium), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Published: 2025-03-12
The record says the vendor was contacted early and did not respond, and names no fixed version. It also says the exploit has been disclosed to the public. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation. The vector lists low privileges, so some form of access to the system is expected.
How to check if you're exposed
This is an ASP.NET application, so start on the web server.
# is the handler present?
find / -name "SaveCrash.ashx" -not -path "*/proc/*" 2>/dev/null
# what has landed in upload folders recently? (adjust the path)
find /path/to/webroot -type f -mtime -90 \( -name "*.aspx" -o -name "*.ashx" -o -name "*.asp" -o -name "*.config" \) 2>/dev/null
On Windows servers, the same checks work from PowerShell with Get-ChildItem -Recurse over the web root. Any script file that you did not deploy, especially in a folder meant for logs, zip files or crash reports, deserves immediate review.
Also check who can reach the handler. If it answers from the public internet and nothing checks who is calling it, exposure is high. A free in-browser dependency scan will cover the libraries in the project, though it does not test the handler itself.
What to do now
- Identify every deployment of the product and the version in use.
- Block or authenticate
/crash/log/SaveCrash.ashxat the web server or reverse proxy so only trusted users can call it. - Configure the upload folder so scripts cannot execute from it, and so only expected file types are served.
- Search the web root for files you did not deploy and investigate any you find before deleting them.
- Ask zzskzy for a fix in writing. If none arrives, plan a replacement, because the vendor did not answer the researcher either.
Why it matters
The weakness is CWE-434, unrestricted upload of a file of a dangerous type, together with CWE-284, improper access control. The public report describes an endpoint meant to receive crash logs that accepts arbitrary files instead.
Upload handlers are risky because the server decides what to do with what it receives. If a file with an executable extension lands in a folder the web server runs, uploading becomes running code. The CVSS score of 6.3 reflects low rated impacts per axis, but the real impact depends on where the file lands and how the server is set up.
Quick check
Is there a patch?
The record names no fixed version and says the vendor did not respond to the disclosure. Treat the product as unpatched.
What is the single most useful control?
Stop scripts from running in any folder that accepts uploads, and require authentication before the handler runs.
Sources
Last reviewed: 19 October 2026.
