WorkPilot — XXE via SSO Metadata Import

hackadvisor

Task: PHP team collaboration platform with SAML SSO metadata import that parses user-supplied XML without disabling external entities. Solution: Inject DOCTYPE with SYSTEM entity pointing to file:///root/flag.txt in the entityID attribute of crafted SAML metadata; flag returned in-band via JSON response.