critical9.8Public exploit code
CVE-2018-14485
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- BlogEngine 3.3 - XML External Entity Injection2019-01-09 · webapps · windows
Impact
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Blogengine | Blogengine.Net | Version 3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/151063/BlogEngine-3.3-XML-External-Entity-Injection.html
- https://github.com/rxtur/BlogEngine.NET/commits/master
- https://www.exploit-db.com/exploits/46106/
- http://packetstormsecurity.com/files/151063/BlogEngine-3.3-XML-External-Entity-Injection.html
- https://github.com/rxtur/BlogEngine.NET/commits/master
- https://www.exploit-db.com/exploits/46106/