MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://gitee.com/moxi159753/mogu_blog_v2/releases
disclosure@vulncheck.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wech…
disclosure@vulncheck.com
https://github.com/moxi624/mogu_blog_v2
disclosure@vulncheck.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855…
disclosure@vulncheck.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855…
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-i…
disclosure@vulncheck.com