Executive brief
MoguBlog is a blogging platform used to host and manage blog content. The WeChat callback handler accepts unauthenticated XML requests without proper security controls, allowing attackers to extract sensitive files from the server or trigger outbound network requests to internal systems. This can lead to data exfiltration and potential lateral movement within network infrastructure.
Technical details
The vulnerability is an XML external entity (XXE) injection in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests. The vulnerability requires no authentication and is remotely exploitable over the network. Resolved entities are reflected in error responses, enabling direct data exfiltration.
Affected products
- MoguBlog MoguBlog through 6.2
Timeline
- 2026-09-11: disclosed