CVE-2025-4531: Seeyon OA Web Application System RCE Flaw

CVE-2025-4531 Overview

CVE-2025-4531 affects Seeyon Zhiyuan OA Web Application System version 8.1 SP2. The vulnerability resides in the postData function within ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class, part of the Beetl Template Handler component. Attackers can manipulate the payrollId argument to trigger code injection [CWE-94]. The flaw is remotely exploitable and requires low-level authenticated access. Public disclosure of the exploit details has occurred, increasing exposure for organizations running the affected version.

Critical Impact

Authenticated remote attackers can inject code through the payrollId parameter processed by the Beetl Template Handler, potentially compromising the integrity and confidentiality of the OA system.

Affected Products

• Seeyon Zhiyuan OA Web Application System 8.1 SP2
• Component: Beetl Template Handler
• File: ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class

Discovery Timeline

• 2025-05-11 - CVE-2025-4531 published to NVD
• 2026-01-15 - Last updated in NVD database

Technical Details for CVE-2025-4531

Vulnerability Analysis

The vulnerability exists in the postData function of the EhrSalaryPayrollServiceImpl class within Seeyon's HR salary module. The function passes the payrollId parameter into the Beetl Template Handler without proper sanitization. Beetl is a Java template engine that supports expression evaluation, which allows attacker-supplied input to be interpreted as template directives rather than data. The weakness is classified under [CWE-74] Improper Neutralization of Special Elements in Output and [CWE-94] Improper Control of Generation of Code.

Root Cause

The root cause is unsafe handling of the payrollId argument before it reaches the template engine. User-controlled input flows directly into Beetl template rendering, where template syntax such as expression delimiters can trigger evaluation of attacker-controlled logic. The application does not validate, escape, or constrain the payrollId value against the expected payroll identifier format. As a result, the template engine treats injected payloads as executable template constructs.

Attack Vector

The attack is launched over the network against an authenticated session. An attacker submits a crafted HTTP request containing a malicious payrollId value to the vulnerable endpoint backed by EhrSalaryPayrollServiceImpl.postData. When the server renders the template, the injected expression executes within the Beetl engine context. Public exploit details have been disclosed through VulDB, lowering the barrier to weaponization. See the VulDB CTI ID #308276 and VulDB #308276 entries for additional technical context.

No verified proof-of-concept code is published in the referenced sources. Refer to the VulDB Submit ID #566097 record for submission-level details from the original reporter.

Detection Methods for CVE-2025-4531

Indicators of Compromise

• HTTP requests targeting the EHR salary payroll endpoints with payrollId values containing Beetl template syntax such as ${ or @ directives.
• Unexpected child processes spawned by the Seeyon OA Java application server following salary module requests.
• Anomalous outbound network connections originating from the OA application server after access to payroll URLs.

Detection Strategies

• Inspect application logs for postData invocations carrying non-numeric or oversized payrollId parameters.
• Deploy web application firewall rules that flag template expression metacharacters in payroll-related request parameters.
• Correlate authentication events with payroll module access to identify low-privilege accounts probing the EHR endpoints.

Monitoring Recommendations

• Enable verbose logging on the Beetl Template Handler and forward logs to a centralized analytics platform for behavioral baselining.
• Monitor the Seeyon OA Java process for file write, shell execution, or class loading events that deviate from normal payroll workflows.
• Track outbound DNS and HTTP traffic from the OA server for connections to unknown hosts following salary module activity.

How to Mitigate CVE-2025-4531

Immediate Actions Required

• Restrict network access to the Seeyon OA Web Application System so only trusted internal users can reach the EHR salary module.
• Audit user accounts and remove unnecessary privileges from accounts that can reach the payroll endpoints.
• Review web server and application logs for prior exploitation attempts referencing the payrollId parameter.

Patch Information

No vendor advisory or fixed version is referenced in the available data. Organizations should contact Seeyon directly to obtain a patched build of Zhiyuan OA Web Application System 8.1 SP2 and validate any remediation against the Beetl Template Handler code path.

Workarounds

• Apply input validation at a reverse proxy or WAF to allow only numeric payrollId values before requests reach the application.
• Disable or restrict the EHR salary payroll endpoints if they are not required for business operations.
• Segment the OA server from sensitive internal systems to limit lateral movement if exploitation occurs.