金和C6 CheckPwd.aspx XML外部实体注入

fofa:

title="金和协同管理平台" || body="js/PasswordCommon.js" || body="js/PasswordNew.js" || body="Jinher Network" || (body="c6/Jhsoft.Web.login" && body="CloseWindowNoAsk") || header="Path=/jc6" || (body="JC6金和协同管理平台" && body="src=\"/jc6/platform/") || body="window.location = \"JHSoft.MobileApp/Default.htm\";" || banner="Path=/jc6"||body="JHSoft.Web.AddMenu" || body="/jc6/platform/sys/login" || body="C6/Jhsoft.Web.login/PassWord.aspx" || body="/jc6/platform/finallogin/images/head-add.png"||body="Jhsoft.Web.login/PassWord.aspx"

poc: