New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wechat-php-sdk 存在XXE漏洞 #35

Open

niubl opened this issue Aug 6, 2018 · 0 comments

niubl commented Aug 6, 2018

漏洞文件：
src/Wechat.php

漏洞原因：
调用simplexml_load_string函数未禁用实体引用，导致攻击者可以读取服务器任意文件

漏洞修复：
在所有调用simplexml_load_string函数前调用libxml_disable_entity_loader(true)禁止实体引用

漏洞证明：
略

报告来自：
niubl of Tencent Blade Team

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment