Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)

Full Disclosure ()1 · 1 read
Read at seclists.org
Part of a story covered by 3 sources0day Rubbish Research Team discloses three unauthenticated file-upload RCE flaws (CVSS 9.8) in PrizmDoc for Java, Ecava IntegraXor IGX, and LCDS Laquis SCADAMerged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

Unauthenticated upload in PrizmDoc for Java 5.22.1 writes a JSP webshell into the webapp root as root.

0day Rubbish Research Team disclosed an unauthenticated file-upload flaw in PrizmDoc for Java (VirtualViewer) 5.22.1. The uploadDocument function writes into the web application root, allowing a JSP webshell (CWE-306) that executes with the JVM's privileges—uid 0 (root) in the deployment the researchers verified. CVSS is given as 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The post advertises a reproducible proof-of-concept and does not cite a CVE or confirmed exploitation.

Key facts
  • Affects PrizmDoc for Java (VirtualViewer) 5.22.1.
  • Unauthenticated uploadDocument writes into the web application root.
  • Result is a JSP webshell running with JVM privileges, uid 0 in the verified deployment.
  • CVSS 9.8 with a claimed public PoC; no CVE or in-the-wild use stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1190 Exploit Public-Facing ApplicationT1505.003 Web Shell
Tags
prizmdocvirtualviewerjspwebshellfile-uploadrceunauthenticated
Vendors
Accusoft
Products
PrizmDoc for JavaVirtualViewer
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in PrizmDoc for Java (VirtualViewer) 5. 22. 1.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.