I wonder, is possible XXE attack in this case?
The data of request is starting with:
<InteractionMessage><Header><SenderApplication>VIP3.0</SenderApplication><ReceiverApplication/><TransactionID>1651397670193</TransactionID><Timestamp>2022-05-01T02:34:30.193-07:00</Timestamp></Header><Body><********><Attachments xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" qid="String" isApplicable="true" location="preference" source="preference"> <*** id="2"> <Attachment id="1" purpose="Rotation"> <Type>Optimized Rotation</Type> <Bevel xsi:nil="true"/> <Orientation xsi:nil="true"/> <Location>CenterCenter</Location> <Surface>****</Surface> <Size units="mm">autosize</Size> <Status>NotChanged</Status> </Attachment> And when I change something like this
<**** id="3"><PrecisionCut id="1"><CutToothSurface>****</CutToothSurface><CutType><Button><Button>true</Button><CutButtonType>Round</CutButtonType></Button><Slit><Slit>false</Slit><CutSlitOrientation>ASDASD</CutSlitOrientation></Slit></CutType><CutStatus>NotChanged</CutStatus></PrecisionCut> This XML data is reflecting in the response
<***** id="3"><PrecisionCut id="1"><CutToothSurface>*****</CutToothSurface><CutType><Button><Button>true</Button><CutButtonType>Round</CutButtonType></Button><Slit><Slit>false</Slit><CutSlitOrientation>ASDASD</CutSlitOrientation></Slit></CutType><CutStatus>NotChanged</CutStatus></PrecisionCut></Tooth> As you can see ASDASD is reflecting on the response (it's same for other params too). I tried classical XXE payloads but data returned null