Bjskzy Zhiyou ERP XML External Entity Injection Vulnerability in RichClientService Component

A vulnerability allowing XML External Entity (XXE) injection has been identified in Bjskzy Zhiyou ERP versions through 11.0. The issue resides in the RichClientService component, specifically within the initRCForm function of the RichClientService.class file. This vulnerability can be exploited remotely, leading to the manipulation of XML documents in a way that external entities are processed, potentially causing the application to reference and embed unintended documents into its output.

Impact

Exploitation of this vulnerability allows for XML External Entity injection, where an attacker can manipulate XML data to include external entities. This could lead to the application processing sensitive data from external sources or causing denial-of-service conditions.