XML Injection Vulnerability in ZeroWdd MyBlog 1.0
CVE-2024-13190
5.3MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2024-13190?
A significant vulnerability exists in ZeroWdd MyBlog version 1.0 due to an XML injection flaw found in the code of the file src/main/resources/mapper/BlogMapper.xml. This vulnerability allows attackers to manipulate input arguments related to findBlogList and getTotalBlogs, enabling harmful XML data to be injected. The attack can be executed remotely, posing a substantial risk to users. This issue has been made public, and users are advised to review the related discussions and mitigation strategies.
Affected Version(s)
myblog 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.