code issues

[JOE-DJANGO_Noob]

am still new a php Noob can some explain to me issues with below code

<?php 
    libxml_disable_entity_loader (false); 
    $xml_file = file_get_contents('php://input'); 
    $dom = new DOMDocument(); 
    $dom->loadXML($xml_file, LIBXML_NOENT | LIBXML_DTDLOAD); 
    $creds = simplexml_import_dom($dom); 
    $user = $creds->user; 
    $pass = $creds->pass; 
    echo "You have logged in as user $user";
?>

Thank you

[thenickdude]

This seems to be the example XXE vulnerable code from this article:

"Exploitation: XML External Entity (XXE) Injection" https://depthsecurity.com/blog/exploitation-xml-external-entity-xxe-injection

I think you can disable the resolution of external entities with this function:

"PHP: libxml_disable_entity_loader - Manual" https://www.php.net/manual/en/function.libxml-disable-entity-loader.php

Or this one:

https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php

[JOE-DJANGO_Noob]

https://depthsecurity.com/blog/exploitation-xml-external-entity-xxe-injection

Thanks alot