CEH Web Application and Injection Attacks Practice Question
A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?
⚠ Common exam trap
The trap is selecting SQL injection or RCE because they are 'impactful' — candidates must remember XXE's direct impacts are file read, SSRF, and DoS, not SQLi or command injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Arbitrary file read on the server
Option B (Arbitrary file read on the server) is correct because XXE payloads can define an external entity whose SYSTEM identifier points to a local file (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), causing the parser to embed the file's contents in the response. Option C (Denial of Service) is correct because entities can be nested or recursively referenced (the 'billion laughs' attack) or point to large/blocking resources, exhausting parser memory or CPU and rendering the service unavailable. Option D (Server-Side Request Forgery) is correct because an external entity with an HTTP/FTP SYSTEM URL forces the vulnerable server to make outbound requests to internal or external hosts, enabling SSRF and potential access to internal services or cloud metadata endpoints. Option A (SQL injection) is not a direct XXE impact — XXE abuses the XML parser, not a database query interface, so any SQLi would be a separate vulnerability. Option E (Remote code execution via command injection) is not a standard XXE consequence; XXE does not invoke OS commands, and RCE typically requires additional flaws such as insecure deserialization or PHP expect:// wrappers in specific misconfigurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection exploits vulnerabilities in database queries, typically through user input manipulating SQL statements. XXE, however, targets the XML parser's handling of external entities, operating on a different application layer entirely. While both are injection flaws, their attack vectors and affected components are distinct, meaning XXE does not directly translate into SQL injection.
- ✓
Arbitrary file read on the server
Why this is correct
XXE vulnerabilities allow an attacker to define external entities that reference local files on the server using the `file://` URI scheme. When the XML parser processes this entity, it attempts to retrieve the content of the specified file, such as `/etc/passwd` or application configuration files. This content is then embedded into the XML response, enabling the attacker to read sensitive system files.
- ✓
Denial of Service (DoS)
Why this is correct
A Denial of Service (DoS) attack via XXE often leverages XML bombs, such as the 'billion laughs' attack, which exploit recursive entity expansion. By defining nested entities that repeatedly reference each other, the XML parser consumes an exponential amount of memory and CPU resources. This rapid resource exhaustion can quickly crash the application or the underlying server, rendering the service unavailable to legitimate users.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Server-Side Request Forgery (SSRF) can be achieved through XXE by defining external entities that instruct the vulnerable XML parser to make HTTP or Gopher requests to arbitrary URLs. This allows an attacker to force the server to connect to internal network resources, cloud metadata APIs, or other services that are not directly exposed to the internet. The server then acts as a proxy, potentially revealing sensitive internal information or interacting with internal services on the attacker's behalf.
- ✗
Remote code execution via command injection
Why it's wrong here
Remote Code Execution (RCE) via command injection is not a direct consequence of an XXE vulnerability itself, as XXE primarily involves XML parsing and entity resolution, not direct operating system command execution. While XXE can be a crucial step in a multi-stage attack chain (e.g., by reading configuration files that expose credentials, or facilitating SSRF to exploit an internal service that *does* allow RCE), it does not inherently provide the capability to inject and execute arbitrary system commands.
Go deeper
Related to this question
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.