CVE-2023-7334
Published: 15 January 2026
Summary
CVE-2023-7334 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Chanjetvip T\+. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-7334 is a .NET deserialization vulnerability (CWE-502) affecting Changjetong T+ versions up to and including 16.x. The flaw resides in an AjaxPro endpoint, specifically at /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore, where the application deserializes untrusted input. This vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
A remote attacker can exploit this vulnerability by sending a crafted HTTP request with a malicious JSON body to the affected endpoint. The deserialization of attacker-controlled .NET types allows invocation of arbitrary methods, such as System.Diagnostics.Process.Start, leading to remote code execution. Commands execute in the context of the T+ application service account, enabling full compromise of the host without requiring authentication or user interaction.
References include proof-of-concept exploit code on GitHub and detailed analyses on CSDN, Freebuf, and the vendor's product page, but no specific patch or mitigation guidance is detailed in the available information. Security practitioners should review these resources for reproduction steps and monitor affected systems.
Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC), predating the CVE publication on 2026-01-15, suggesting active in-the-wild use prior to formal disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-60535
Vulnerability details
Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that…
more
leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical unauthenticated .NET deserialization flaw in a public-facing AjaxPro web endpoint, directly enabling remote code execution via crafted HTTP requests, mapping precisely to Exploit Public-Facing Application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the .NET deserialization flaw in the AjaxPro endpoint by identifying, patching, or upgrading vulnerable Changjetong T+ versions.
Validates malicious JSON inputs to the GetStoreWarehouseByStore method to block deserialization of attacker-controlled .NET types leading to RCE.
Disables or restricts the unnecessary AjaxPro endpoint to eliminate exposure to the deserialization vulnerability.