Description
用友NC系统存在XML外部实体注入（XXE）漏洞。攻击者可通过构造恶意XML文件，利用importCombo接口上传并解析，实现任意文件读取或SSRF攻击等攻击
用友NC importCombo XML实体注入（XXE）漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://mrxn.net/jswz/yonyou-nc-portalcombo-importCombo-xxe.html
https://cn-sec.com/archives/4983739.html
https://www.gm7.org/archives/38995
https://www.ddpoc.com/DVB-2025-9897.html
https://security.zone.ci/secarticles/wx/494031.html
https://mdr.skyeye.qianxin.com/forum/article/787