CVE-2013-3617

This XML payload demonstrates an XXE (XML External Entity) vulnerability in Openbravo ERP, allowing an attacker to read arbitrary files (e.g., /etc/passwd) by exploiting improper XML entity processing. The PoC includes a malicious DTD declaration that references an external file, which is then embedded in the XML structure.

This Metasploit module exploits an XXE vulnerability in Openbravo ERP to read arbitrary files from the server. It authenticates, crafts a malicious XML payload with an external entity reference, and retrieves the file contents via the API response.