If you Google for an example of XXE injection you get something like this:
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///dev/random" >]><foo>&xxe;</foo>
where the attack is carried out from within the DTD - so at the very top of a document.
Is it instead possible to inject XML External Entities from within the body of an XML document rather than its DTD and, if so, how?
EDIT: As an example, we have a system that generates XML documents with some user-provided data from a database. The system does escape those values using CDATA but doesn't do anything else to it, so you (as a - malicious - user) could easily store some data to close the CDATA section and write XML. So long as the XML is correct and passes some XSD validation, the system is a happy system.
EDIT: Could xs:import (or similar) be used?