Path Traversal Vulnerability in QiAnXin TianQing Management Center
CVE-2024-13984

10CRITICAL

Key Information:

Vendor

Qi'anxin

Status
Tianqing Management Center
Vendor
CVE Published:
27 August 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-13984?

The QiAnXin TianQing Management Center has a path traversal vulnerability that affects versions 6.7.0.4130 and earlier. This vulnerability is present in the rptsvr component, which allows unauthenticated attackers to upload files to arbitrary locations on the server. Specifically, the /rptsvr/upload endpoint does not adequately sanitize the filename parameter in multipart form-data requests. By exploiting this flaw, attackers can place executable files in web-accessible directories, posing a significant risk of remote code execution.

Affected Version(s)

TianQing Management Center * <= 6.7.0.4130

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-13984 - Proof of Concept

CVE-2024-13984 - Proof of Concept

References

https://cn-sec.com/archives/2421288.html
technical-descriptionexploit
https://blog.csdn.net/maxiluo/article/details/135865584
technical-descriptionexploit
https://www.qianxin.com/product/detail/pid/330
product

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lanyue Security Team
.
CVE-2024-13984 : Path Traversal Vulnerability in QiAnXin TianQing Management Center