This is a simple application that can be used to demo XXE vulnerabilities.

For easy setup simply use Apache with PHP and the DOMDocument package.
On Ubuntu, the DOMDocument package can be easy installed with the following
command:

# apt-get install php-fdomdocument

Just unpack it and everything should work out of box.
The app simulates a simple order processing system where users upload
XML files which are parsed by the app.
There are 2 example XML order files that can be downloaded.

Configuration is in config.php:
- just set the $orderdir directory, it can remain as it is
- the $login arrays contains username/password pairs. I thought it
will be easier than using MySQL and complicating the setup