Description 金和 /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx 存在 XML 外部实体注入漏洞,攻击者可以通过构造恶意的 XML 请求来利用该漏洞。
References https://www.nsfocus.net/vulndb/125116 https://www.knowsafe.com/ti/info/0/998465 https://nosec.org/m/share/5896.html https://nvd.nist.gov/vuln/detail/CVE-2025-7523 https://www.tenable.com/cve/CVE-2025-7523 https://vuldb.com/?id.316220 https://github.com/BigMancer/Jinhe-OA-XXE-Vulnerability
Related Vulnerabilities金和OA /c6/JHSoft.Web.CostControl/Decompose/AjaxForCenterBudgetDecompose.ashx SQL 注入漏洞金和OA /c6/JHSoft.Web.CostControl/BudgetExecution/VouchUpdate.aspx SQL 注入漏洞金和OA /C6/Jhsoft.Web.departments/GetTreeDate.aspx SQL 注入漏洞(CVE-2025-10090)北京金和网络股份有限公司金和OA系统存在SQL注入漏洞金和OA CostApplyHandler.ashx SQL注入漏洞金和OA AjaxForDepartmentCollect.ashx SQL注入漏洞金和OA EpassInitTakenSnInva.aspx XXE漏洞金和OA EpassValidate.aspx XXE漏洞金和OA EpassInitTakenSnExec.aspx XXE漏洞金和OA LstGroupXml.aspx XXE漏洞金和OA RegCodeInfo.aspx XXE漏洞金和OA CrmSystemSet XXE漏洞金和OA Departments-XmlHttp XXE漏洞