Description
SysAid On-Prem版本<= 23.3.40在Checkin处理功能中存在未经身份验证的XML外部实体（XXE）漏洞，该漏洞允许攻击者读取文件。
SysAid On-Prem 存在XML注入漏洞 (CVE-2025-2775)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-2775
https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
https://www.sonicwall.com/blog/critical-sysaid-xxe-vulnerabilities-expose-systems-to-remote-exploitation-cve-2025-2775-2777-
https://arcticwolf.com/resources/blog/cve-2025-2775/
https://www.ionix.io/threat-center/cve-2025-2775/
https://op-c.net/blog/cisa-alert-sysaid-vulnerabilities-cve-2025-2775-2776/
https://github.com/advisories/GHSA-g3m4-2wr6-2q64
https://documentation.sysaid.com/docs/24-40-60
https://www.ddpoc.com/DVB-2025-9991.html
https://www.tenable.com/cve/CVE-2025-2775