Xml Arbitrary File Read vulnerability and Remedy

 

I circled a forum in a black broad forum and found the xml read Arbitrary File Vulnerability.
As a result, I suddenly think of the xmlgetshell of dz, which is a little dangerous. So I will release it here.
With php + xml, any file can be read as long as you have the permission,

Simple_xml_string, xml_parse, and DOMDocument are used in different ways.

According to the prompts on the official php website, the first is to use libxml

The two also use libxml

The third one uses expat.

Libxml supports parsing external files, but expat does not parse external files.

So this makes expat safer when processing xml, so it is safer to replace simple_xml_string with xml_parse.

From network security technology blog (http://www.0day.la)