CVE-2023-7307

Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity definitions, leading to potential disclosure of internal files, server-side request forgery (SSRF), or other impacts depending on parser behavior. The vulnerability is due to improper configuration of the XML parser, which allows resolution of external entities without restriction. This product is now integrated into their IAM (Internet Access Management) platform and an affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-09-06 UTC.

• CWE-611

• https://support.sangfor.com.cn/productDocument/read?product_id=22&version_id=329&category_id=261800
• https://www.cnblogs.com/pursue-security/p/17666126.html
• https://www.sangfor.com/blog/cybersecurity/launching-sangfor-iam-12-0-23-manage-risky-shadow-it-right-way
• https://www.vulncheck.com/advisories/sangfor-behavior-management-system-xml-external-entity-injection

Published

Aug 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-7299A vulnerability was found in DataGear up to 4.60. It has bee…9.8
• CVE-2023-7300Huawei Home Music System has a path traversal vulnerability.…8
• CVE-2023-7303A vulnerability, which was classified as problematic, was fo…5.1
• CVE-2023-7304Ruijie RG-UAC Application Management Gateway contains a comm…9.3
• CVE-2023-7305SmartBI V8, V9, and V10 contain an unrestricted file upload …9.2
• CVE-2023-7306The Frontend File Manager Plugin plugin for WordPress is vul…7.5
• CVE-2023-7308SecGate3600, a network firewall product developed by NSFOCUS…7.5
• CVE-2023-7309A path traversal vulnerability exists in the Dahua Smart Par…10
• CVE-2023-7311BYTEVALUE Intelligent Flow Control Router contains a command…9.3
• CVE-2023-7312Nagios Fusion versions prior to 4.2.0 contain a stored cross…4.8
• CVE-2023-7313Nagios XI versions prior to 5.11.3 are vulnerable to cross-s…5.4
• CVE-2023-7314Nagios XI versions prior to 5.11.3 are vulnerable to cross-s…5.4