Square Victoria O2O business system SQL injection vulnerability+XXE entity injection demo validation-vulnerability warning-the black bar safety net

Square Victoria O2O, the demo site address: http://o2odemo.fanwe.net/ /cpapi/qxtapi.php code area define"FILEPATH","/cpapi"; requireonce '../system/systeminit.php'; $ip = CLIENTIP; $xml = filegetcontents'php://input'; if$ip!=' 221.179.180.156' || $xml=="" header"Content-Type:text/html;...