Lab 140 — Pressboard — XXE via RSS Feed Import

hackadvisor

Task: Pressboard CMS has an RSS feed import feature that fetches and parses external XML using lxml with default settings. Solution: Crafted a malicious RSS XML with an XXE payload referencing file:///root/flag.txt, hosted it on the internal Interaction Server, and imported it — the flag appeared as an article title.