Description
Oracle PeopleSoft Enterprise PeopleTools 是 Oracle 公司提供的一套企业管理工具和技术平台组件。其 /PSIGW/PeopleSoftServiceListeningConnector 接口存在 XML 外部实体注入（XXE）漏洞，攻击者可以通过构造恶意的 XML 请求读取服务器上的敏感文件或与外部服务器交互，可能导致信息泄露或部分拒绝服务（partial DOS）。
Oracle PeopleSoft /PSIGW/PeopleSoftServiceListeningConnector XML 外部实体注入漏洞（CVE-2017-3548）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2017-3548
https://www.exploit-db.com/exploits/41925
https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/
https://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
https://github.com/shadowsock5/notes/blob/master/Attacking-Oracle-PeopleSoft.md
https://blog.lexfo.fr/oracle-peoplesoft-xxe-to-rce.html
https://www.securityfocus.com/bid/97880
https://www.securitytracker.com/id/1038301
https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:ORACLE:PEOPLESOFT-XXE.html