CVE-2014-7176

This is a vulnerability writeup describing an authenticated blind SQL injection in Tuleap <= 7.4.99.5. The advisory details the affected parameters and URLs but does not include functional exploit code.

This exploit demonstrates an XML External Entity (XXE) injection vulnerability in Tuleap <= 7.2, allowing an authenticated attacker to read local system files (e.g., /etc/passwd) by uploading a maliciously crafted XML file via a multipart/form-data POST request.