CVE-2019-9761

Vulnerability

PHPSHE version 1.7 is vulnerable to an XML External Entity (XXE) injection in the wechat_getxml function located in include/plugin/payment/wechat/notify_url.php. The application does not disable external entity processing when parsing XML data from the WeChat payment notification. This issue is documented in the advisory [1].

Exploitation

An attacker can exploit this vulnerability without authentication by sending a crafted XML payload to the WeChat payment notify endpoint. The payload includes an external entity that references either a local file (e.g., file:///etc/passwd) or an internal network resource (e.g., via HTTP to an internal IP). The server processes the entity and returns the contents in the response, enabling data exfiltration or internal network scanning.

Impact

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server’s filesystem and perform port scanning or service detection against internal network hosts. This compromises confidentiality and can aid in further attacks against the internal network.

Mitigation

As of the available references [1], no official patch or fixed version has been released for PHPSHE 1.7. Users should disable XML external entity processing in the affected code or restrict network access to the notification endpoint until a patch is applied.