| عنوان | Zhilink (Shenzhen) Technology Co., Ltd. ADP Application Developer Platform V1.0.0 XML External Entity Injection (CWE-611) |
|---|
| الوصف | A critical XML External Entity (XXE) injection vulnerability exists in the /adpweb/a/base/barcodeDetail/import endpoint. The application fails to properly sanitize or validate the uploaded Excel files during the barcode detail import process. An authenticated remote attacker can upload a specially crafted Excel file containing malicious XML entities, which are subsequently parsed by the XML parser without disabling external entity resolution. Successful exploitation allows the attacker to read arbitrary files on the server (e.g., /etc/passwd), perform Server-Side Request Forgery (SSRF) attacks to scan internal network ports, and potentially achieve remote code execution, leading to a full system compromise. |
|---|
| المصدر | ⚠️ https://ucn9h68n9289.feishu.cn/docx/LeLOdhV6mo3clzxstxXcpFzbnjg?from=from_copylink |
|---|
| المستخدم | bigbrother_man (UID 96003) |
|---|
| ارسال | 22/05/2026 10:14 AM (1 شهر منذ) |
|---|
| الاعتدال | 20/06/2026 11:58 AM (29 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 372530 [zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import XML External Entity] |
|---|
| النقاط | 20 |
|---|