| शीर्षक | Feng Office >= v3.2.2.1 XXE |
|---|
| विवरण | Feng Office has a blind XXE vulnerability that can be exploited via document upload.
It's possible to leverage this vulnerability to exfiltrate data from local files and to achieve SSRF.
If PECL expect were installed, this could be escalated to RCE. Depending on the PHP version installed phar:// may also be used to escalate the attack. |
|---|
| स्रोत | ⚠️ https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa |
|---|
| उपयोगकर्ता | mcdruid (UID 79710) |
|---|
| सबमिशन | 29/05/2025 07:35 PM (1 वर्ष पहले) |
|---|
| संयम | 08/06/2025 08:05 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 311636 [Fengoffice Feng Office 3.2.2.1 Document Upload ApplicationDataObject.class.php XML External Entity] |
|---|
| अंक | 18 |
|---|