uzy-ssm-mall XML External Entity (XXE) Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing XML External Entity (XXE) attacks has been identified in uzy-ssm-mall version 1.1.0, specifically within the wxpay component. This vulnerability arises because the application directly parses the request body as XML without disabling external entities, enabling attackers to execute arbitrary code by sending crafted XML data.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, send a request to the /mall/wxpay/pay endpoint with XML data that includes a reference to an external entity. The XML parser will process the external entity, allowing for potential code execution or access to sensitive files, depending on the crafted payload.