Key Information Summary Vulnerability Name Jinhe OA XXE Vulnerability #3 Affected Product Jinhe OA (OA All-in-One System) Affected Versions No specific version mentioned, but the vulnerable file is identified as Vulnerability Type XML External Entity (XXE) Injection Root Cause An XXE injection vulnerability was discovered in . This vulnerability allows attackers to read sensitive files on the server by exploiting external entity references. Impact Attackers can exploit this vulnerability to read arbitrary files on the target server, including configuration files and database contents, leading to data leakage. Description The vulnerability exists in the file . Attackers can trigger the vulnerability by crafting malicious XML requests, enabling them to read arbitrary files on the server. Vulnerability Location Exploitation Method 1. Create a file named with the following content: 2. Use a personal server to execute the DTF file to read the contents of the target server's C drive. 3. The DTF file implements an Out-of-Band (OOB) attack technique, exfiltrating data to an external location. 4. The stolen data is written to via the script. Quick Verification Method Provides a specific XML request example to verify the presence of the vulnerability. File Reading Exploitation Detailed description of how to construct specific XML requests to read files on the target server. Recommended Remediation 1. Upgrade Jinhe OA to the latest version. 2. Apply official patches provided by the vendor. 3. Configure a Web Application Firewall (WAF) to detect and block malicious requests. ``` This information provides key details about the Jinhe OA XXE vulnerability, including its scope of impact, exploitation techniques, and remediation recommendations.