A critical XML External Entity injection vulnerability in Bjskzy Zhiyou ERP version 11.0 allows for unauthenticated remote exploitation, posing a significant risk of data exposure.

The vulnerability exists in the com.artery.richclient.RichClientService class within the openForm function, which improperly processes XML input provided via the contentString argument. Because the application fails to perform authentication or sanitize this input, an unauthenticated attacker can inject malicious XML entities to read local system files or perform server-side request forgery.

The ability for an unauthenticated remote attacker to perform XXE injection carries a severe business risk, as it allows for the unauthorized disclosure of sensitive internal configuration files, credentials, or proprietary data. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it facilitates potential system compromise and lateral movement within the network. Failure to address this vulnerability could result in significant data breaches and potential regulatory non-compliance.

Immediate Action: As no vendor patch is currently available, administrators should restrict network access to the affected ERP service, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor server logs for anomalous POST requests containing XML tags or references to external entities, which may indicate attempted exploitation of the openForm function.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XML content that contains DOCTYPE declarations or external entity references.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an urgent security risk. Organizations currently utilizing Bjskzy Zhiyou ERP version 11.0 must prioritize isolation of the affected system from external networks and implement robust WAF filtering to mitigate the risk of unauthorized data access.