| Titel | Zhilink (Shenzhen) Technology Co., Ltd. ADP Application Developer Platform V1.0.0 XML External Entity Injection (CWE-611) |
|---|
| Beschreibung | A critical XML External Entity (XXE) injection vulnerability exists in the /adpweb/a/base/barcodeDetail/import endpoint. The application fails to properly sanitize or validate the uploaded Excel files during the barcode detail import process. An authenticated remote attacker can upload a specially crafted Excel file containing malicious XML entities, which are subsequently parsed by the XML parser without disabling external entity resolution. Successful exploitation allows the attacker to read arbitrary files on the server (e.g., /etc/passwd), perform Server-Side Request Forgery (SSRF) attacks to scan internal network ports, and potentially achieve remote code execution, leading to a full system compromise. |
|---|
| Quelle | ⚠️ https://ucn9h68n9289.feishu.cn/docx/LeLOdhV6mo3clzxstxXcpFzbnjg?from=from_copylink |
|---|
| Benutzer | bigbrother_man (UID 96003) |
|---|
| Einreichung | 22.05.2026 10:14 (vor 1 Monat) |
|---|
| Moderieren | 20.06.2026 11:58 (29 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 372530 [zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import XML External Entity] |
|---|
| Punkte | 20 |
|---|