CVE-2025-1388

CVE-2025-1388, published on 2025-02-17, is an Arbitrary File Upload vulnerability (CWE-434) in Orca HCM, a human capital management software product from LEARNING DIGITAL. The flaw enables remote attackers with regular privileges to upload arbitrary files, including web shells, due to insufficient validation of uploaded file types.

Attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required, provided they possess low-level (regular) privileges on the affected system. Successful exploitation allows attackers to execute uploaded web shells, resulting in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Advisories from TWCERT detail the vulnerability and are available at https://www.twcert.org.tw/en/cp-139-8430-32513-2.html and https://www.twcert.org.tw/tw/cp-132-8429-07d7e-1.html.