Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-37192. PoCs published by ZwX.
AI-analyzed exploit summary This exploit demonstrates an XML External Entity (XXE) injection vulnerability in MSN Password Recovery 1.30, allowing an attacker to read arbitrary files from the target system by leveraging a malicious DTD file hosted on a local server.
Description
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.
Exploits (1)
This exploit demonstrates an XML External Entity (XXE) injection vulnerability in MSN Password Recovery 1.30, allowing an attacker to read arbitrary files from the target system by leveraging a malicious DTD file hosted on a local server.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N