Revisting XXE and abusing protocols

This report demonstrates a proof-of-concept XML External Entity (XXE) vulnerability in OpenID YADIS discovery. The author crafts malicious XRDS documents that cause victim servers to fetch attacker-controlled resources, enabling file exfiltration (using php://filter to base64-encode files) and, where PHP handlers are available, remote code execution (expect://). The write-up includes payload examples, test results, and a mitigation recommendation to disable entity loading in libxml.