Posted by Patrick Webster via Fulldisclosure on Apr 04

https://www.osisecurity.com.au/manhattan-software-iwms-integrated-workplace-management-system-xml-external-entity-xxe-injection-file-disclosure.html

Date:
04-Apr-2017

Product:
Trimble / Manhattan Software IWMS (integrated workplace management system)

Versions affected:
9.x

Vulnerability:
XML External Entity injection (XXE)

Example:

There is an XXE in services such as:

https://[target]/services/WSFUNCTION
https://[target]/services/WSGRID…