Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-1202. PoCs published by Barak Tawily.
AI-analyzed exploit summary This exploit demonstrates a remote code execution vulnerability in SoapUI via a malicious WSDL file. The payload uses the `${=JAVA CODE};` syntax to execute arbitrary Java code (e.g., `Runtime.getRuntime().exec('calc.exe')`) when a victim imports the WSDL and sends a request.
Description
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Exploits (1)
This exploit demonstrates a remote code execution vulnerability in SoapUI via a malicious WSDL file. The payload uses the `${=JAVA CODE};` syntax to execute arbitrary Java code (e.g., `Runtime.getRuntime().exec('calc.exe')`) when a victim imports the WSDL and sends a request.