CEH Web Application and Injection Attacks Practice Question
A web application uses XML to transmit data between client and server. A tester submits the following payload: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
XML External Entity (XXE) injection
This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. It typically involves inserting malicious SQL code into input fields, which is then executed by the database server. This attack vector is fundamentally different from manipulating XML entities, as it targets the database layer directly, not the XML parsing or data transmission mechanism itself. Therefore, it does not directly exploit vulnerabilities within XML data structures.
- ✓
XML External Entity (XXE) injection
Why this is correct
XML External Entity (XXE) injection is a vulnerability that allows an attacker to interfere with an application's processing of XML data containing external entity references. By crafting malicious XML input, an attacker can exploit improperly configured XML parsers to include arbitrary files from the server's filesystem, initiate Server-Side Request Forgery (SSRF) attacks, or even execute remote code in certain environments. This directly leverages the application's use of XML for data transmission, making it the most relevant attack type when XML entity manipulation is implied.
- ✗
Command injection
Why it's wrong here
Command injection is an attack in which the goal is the execution of arbitrary commands on the host operating system via a vulnerable application. This vulnerability arises when an application passes unsanitized user-supplied input to a system shell. Unlike XXE, which manipulates how an XML parser processes data, command injection directly targets the operating system's command execution capabilities, making it distinct from XML entity-based attacks.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into otherwise benign and trusted websites. These scripts are executed by the victim's browser, allowing attackers to bypass access controls, steal cookies, or deface websites. XSS primarily targets the user's browser and the web page rendering process, rather than exploiting vulnerabilities in how an application processes or transmits XML data between server and client.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.