An endpoint that parses XML

A normal import

The target accepts a profile as XML at /app/import and echoes the name it parsed. Post a well-formed profile and it behaves:

curl -s -X POST --data-binary '<profile><name>Alice</name></profile>' http://127.0.0.1:8080/app/import

In the terminal

student@vulntech:~$ curl -s -X POST --data-binary '<profile><name>Alice</name></profile>' http://127.0.0.1:8080/app/import
Imported profile for: Alice

Simple enough — the parser read <name> and handed it back. The danger is in how it parses: this one allows a document to declare its own entities and resolve external ones.