XXE in SimpleSAMLphp xml-common XML Parsing

This repository is a small, focused exploit PoC consisting of one Python script and a minimal README. The main file, CVE-2024-52806-PoC.py, is a standalone command-line exploit for pre-authentication XXE file read against SimpleSAMLphp, explicitly targeting the SAML ACS endpoint that processes POSTed SAMLResponse data before authentication or signature validation. The script builds a malicious XML payload, base64-encodes it as a SAMLResponse, and POSTs it to the target ACS path. Its core capability is arbitrary file read from the target server using XXE with php://filter wrappers, then exfiltrating the file contents in-band via libxml parse errors rendered in the HTTP response. The default mode is fully self-contained and uses a data: URI to embed the malicious DTD, avoiding any need for outbound connectivity from the target. An optional listener mode starts a local dual-stack HTTP server to host the DTD if inline delivery is impractical. The script also saves the raw response locally and attempts to extract and decode the double-base64 leaked content automatically. Overall, this is a real operational PoC exploit rather than a detector: it performs exploitation, supports configurable target URL/prefix/SP/file path, and returns stolen file contents when successful.