Description
Apache OFBiz 中存在一个服务器端模板注入漏洞。该漏洞是由于应用程序对用户提供的数据的验证不当导致的。
Apache OFBiz createAnonContact 服务端模板注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.secrss.com/articles/76460
https://zhuanlan.zhihu.com/p/30171765218
https://it.shanghaitech.edu.cn/2025/0310/c8406a1108089/page.htm
https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:APACHE:OFBIZ-CRTANON-SSTI.html
https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7?utm_source=feedly
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/framework/Apache-OfBiz-%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%AB%AF%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5-SSTI.md
https://blog.csdn.net/C20220511/article/details/146253410
https://avd.aliyun.com/product?prod=ofbiz
https://nic.seu.edu.cn/info/1047/1182.htm
https://www.jscfa.edu.cn/zhxyzx/2025/0416/c2073a35774/page.htm