cve/2019/CVE-2019-8997.md

### [CVE-2019-8997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8997)
![](https://img.shields.io/static/v1?label=Product&message=BlackBerry%20AtHoc&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=XML%20External%20Entity%20Injection%20(XXE)&color=brighgreen)

### Description

An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field.

### POC

#### Reference
- http://support.blackberry.com/kb/articleDetail?articleNumber=000047227
- http://support.blackberry.com/kb/articleDetail?articleNumber=000047227

#### Github
- https://github.com/0xT11/CVE-POC
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/nxkennedy/CVE-2019-8997