The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the users input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Eyoucms | Eyoucms | 1.5.4 (including) | 1.5.4 (including) |