crmeb_java XML External Entity Injection Vulnerability in WeChatMessageController

A XML External Entity (XXE) injection vulnerability has been identified in crmeb_java versions through 1.3.4. The issue arises in the webHook function of the WeChatMessageController.java file, where improper handling of XML input allows for external entities to be referenced and potentially exploited. This vulnerability can be exploited remotely and has been publicly disclosed, with a proof-of-concept exploit available.

Impact

Exploitation of this vulnerability allows for arbitrary file reading and could be used to access internal network information, according to the vulnerability disclosure.