CVEs-PoC/2016/CVE-2016-2175.md

CVE-2016-2175

Description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

POC

Reference

• http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html
• http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html

Github

• https://github.com/0xCyberY/CVE-T4PDF
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Anonymous-Phunter/PHunter
• https://github.com/CGCL-codes/PHunter