Ywoa XML External Entity Reference Vulnerability in WXCallBack Interface

A vulnerability allowing XML external entity (XXE) injection has been identified in Ywoa versions prior to 2024.07.03. This issue arises in the WXCallBack interface, specifically within the XMLParse.java file, where the extract function improperly handles XML data. The vulnerability can be exploited remotely, potentially leading to unauthorized access or manipulation of XML data.

Impact

Exploitation of this vulnerability allows for XML external entity injection, which can be used to read sensitive files on the server or perform a denial-of-service attack by causing the application to hang or crash.

Remediation

Users are advised to upgrade to Ywoa version 2024.07.04 or later to address this vulnerability.