[Bacardi]

I got a phish email today and decided to scan the host with acunetix. This alert came up.

XML External Entity Injection And XML Injection

First time I've encountered this and so far it's pretty nice. I can access C:\Windows folder of the hosting company! Also the hosts file.
Although, I can't access C:\ or Program Files.

My question is: What can I do with this?

[RyanC]

I got a phish email today and decided to scan the host with acunetix. This alert came up.

XML External Entity Injection And XML Injection

First time I've encountered this and so far it's pretty nice. I can access C:\Windows folder of the hosting company! Also the hosts file.
Although, I can't access C:\ or Program Files.

My question is: What can I do with this?

You can read their files, and scan their internal network.