vendor:
BlogEngine
by:
Aaron Bishop
7.5
CVSS
HIGH
XML External Entity Injection
611
CWE
Product Name: BlogEngine
Affected Version From: 3.3.7
Affected Version To: 3.3.6
Patch Exists: YES
Related CWE: CVE-2019-10718
CPE: a:blogengine.net:blogengine:3.3.7
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: 3.3.7, 3.3.6
2019
Out-of-band XML External Entity Injection on BlogEngine.NET
BlogEngine.NET is vulnerable to an Out-of-Band XML External Entity Injection attack on /pingback.axd. Host the malicious DTD on a web server that is accessible to the target system and submit a request to pingback.axd containing a malicious XML body. The application will request the remote DTD and submit a subsequent request containing the contents of the file.
Mitigation:
Ensure that the application is not vulnerable to XML External Entity Injection attacks by validating all user-supplied input.
