webProeasy
Lab 140 — Pressboard — XXE via RSS Feed Import
hackadvisor
Task: Pressboard CMS has an RSS feed import feature that fetches and parses external XML using lxml with default settings. Solution: Crafted a malicious RSS XML with an XXE payload referencing file:///root/flag.txt, hosted it on the internal Interaction Server, and imported it — the flag appeared as an article title.
$ ls tags/ techniques/
xxe_file_readexternal_entity_injectionrss_feed_import_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 139 — HireFlow — XXE via XML Application Intake— hackadvisor
- [web][Pro]Lab 33 — PulsePress — Reflected XSS in Search Page— hackadvisor
- [web][Pro]XXE read— web-kids20
- [web][Pro]Lab 13 — WebForge — Insecure Deserialization in Config Import— hackadvisor
- [web][Pro]Lab 38 — PipelineForge — XXE in XML Pipeline Import— hackadvisor