{"uuid": "a5bc437e-4393-49ae-8b37-25add071f161", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-26564", "type": "seen", "source": "https://t.me/hacking_Attack/18404", "content": "Exploit Collector\nObjectPlanet Opinio 7.13 / 7.14 XML Injection\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.\n\nMD5 | 42b0801a736a8c5f0e5d56cd04363a4e\n\nDownload\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection\n# Vendor Homepage: https://www.objectplanet.com/opinio/\n# Software Link: https://www.objectplanet.com/opinio/\n# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng\n# CVE: CVE-2020-26564\n\n# Timeline\n- September 2020: Initial discovery\n- October 2020:  Reported to ObjectPlanet\n- November 2020:  Fix/patch provided by ObjectPlanet\n- July 2021:  CVE-2020-26564\n\n# 1. Introduction\nOpinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.\n\n# 2. Vulnerability Details\nObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.\n\n# 3. Proof of Concept\n\n### XXE leading to local file disclosure ###\n\nStep 1: \n\nURL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css\n\nOpinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection\nThe existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with: \n-------------------------------------------------------\n\nStep 2: \n\nUtilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:\n\">\n\"file:////C:\\\n%dtd;\n\nEnsure the surveyIntro tag is inserted with the following payload (This will output the result in the\nsurveyIntro field):\n\n> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to. \n\nImport the modified .xml file to: \n/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']\n\n-------------------------------------------------------\n\nStep 3: \n\nThe C:\\Users\\ directory can be viewed at :\n/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id\nThis vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html\n# 4. Remediation\nApply the latest fix/patch from objectplanet.\n\n# 5. Credits\nTimothy Tan (https://sg.linkedin.com/in/timtjh)\nKhor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)\nYu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)\nDaniel Tan (https://www.linkedin.com/in/dantanjk/)\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:30.386577Z"}