note 106648 deleted from example.xml-external-entity by thiago
| From: | thiago@php.net | Date: | Thu, 24 Nov 2011 16:18:53 +0000 |
| Subject: | note 106648 deleted from example.xml-external-entity by thiago | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-184658@lists.php.net to get a copy of this message | ||
Note Submitter: sjon at hortensius dot net
----
I think I just found the most enterprise looking EVAL replacement ever!
Seriously, this should be removed from PHP asap.
Have a look at some exploits that are possible by default: https://www.owasp.org/index.php/Testing_for_XML_Injection_(OWASP-DV-008)#Tag_Injection