ZS-Admin vulnerabilities

Unrestricted file upload vulnerability in ZS-Admin up to version b52e145. An unknown function in /api/system/file/upload in the SysFileController component does not restrict the uploaded file type, allowing remote upload of arbitrary files. The exploit is public.

Vulnerability in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The getTenantId function in /api/system/sys/dept/page of the MyBatis-Plus Tenant Plugin allows authorization bypass via manipulation of the X-Tenant-Id argument. Remote attack, exploit publicly available.

In ZS-Admin up to version b52e14536d59fda11e56e2536a1c32e82a38cead, the function OrderItem.asc/OrderItem.desc in file /api/system/sys/dept/page of component com.zs.sys.dept.controller.SysDeptController is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be carried out remotely. The exploit has been publicly disclosed.