CVE-2023-7334 Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE
Remote attackers can execute arbitrary code via unsafe .NET deserialization in the T+ ERP application's AjaxPro endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7334?
CVE-2023-7334 is a critical unsafe deserialization vulnerability in Changjetong Information Technology Co., Ltd. T+, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).
Weakness: CWE-502
Which versions are affected by CVE-2023-7334?
It affects 1 product.
Products include Chanjetvip T\+.
How do I fix CVE-2023-7334?
No fix has been published for CVE-2023-7334 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-7334 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7334 exists.
Other vulnerabilities in Changjetong Information Technology Co., Ltd. T+
Sources
Also known as GHSA-rx3f-2v3q-q7mq.