mirror of
https://github.com/0xMarcio/cve.git
synced 2025-05-07 19:16:22 +00:00
24 lines
961 B
Markdown
24 lines
961 B
Markdown
|
### [CVE-2019-13358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13358)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- http://packetstormsecurity.com/files/164253/OpenCats-0.9.4-2-XML-Injection.html
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/0xaniketB/TryHackMe-Empline
|
||
|
|
- https://github.com/20142995/Goby
|
||
|
|
- https://github.com/ARPSyndicate/cvemon
|
||
|
|
- https://github.com/HimmelAward/Goby_POC
|
||
|
|
- https://github.com/Jake-Ruston/Proof-Of-Concepts
|
||
|
|
- https://github.com/Z0fhack/Goby_POC
|
||
|
|
- https://github.com/elouatih/securite_devoirs
|
||
|
|
|