I have been trying to understand the famous CosmicSting so i have setup a local Magento 2.4.0 site and i have install vs code for debugging even though i am still far from understanding PHP classes.

So here is the error i get in the log

Exception has occurred: TypeError
Argument 2 passed to Magento\Framework\Reflection\TypeProcessor::resolveFullyQualifiedClassName() must be of the type string, null given, called in /opt/lampp/htdocs/public_html/vendor/magento/framework/Reflection/TypeProcessor.php on line 555

for posting json below to http://127.0.0.1 running apache with PHP 7.4.33

{
              "address": {
                "totalsReader": {
                  "collectorList": {
                    "totalCollector": {
                      "sourceData": {
                        "data": "   ",
                        "options": 16
                      }
                    }
                  }
                }
              }
            }

I have spent 2 days trying to understand whether this version isnt vulnerable or not, But then its reaching SimpleXmlElement here i have used php_error.log to track what is what but still.

[20-Jul-2026 18:36:42 UTC] Declaring class: Magento\Quote\Model\Quote\TotalsCollectorList
[20-Jul-2026 18:36:42 UTC] Parameter: totalCollector
[20-Jul-2026 18:36:42 UTC] getType(): ReflectionNamedType::__set_state(array(
))
[20-Jul-2026 18:36:42 UTC] Builtin: no
[20-Jul-2026 18:36:42 UTC] Type name: Magento\Quote\Model\Quote\Address\Total\Collector
[20-Jul-2026 18:36:42 UTC] Declaring class: Magento\Quote\Model\Quote\TotalsCollectorList
[20-Jul-2026 18:36:42 UTC] Parameter: totalCollector
[20-Jul-2026 18:36:42 UTC] getType(): ReflectionNamedType::__set_state(array(
))
[20-Jul-2026 18:36:42 UTC] Builtin: no
[20-Jul-2026 18:36:42 UTC] Type name: Magento\Quote\Model\Quote\Address\Total\Collector
[20-Jul-2026 18:36:42 UTC] Magento\Quote\Model\Quote\TotalsCollectorList::__construct parameter $totalCollector type='Magento\\Quote\\Model\\Quote\\Address\\Total\\Collector'
[20-Jul-2026 18:38:17 UTC] Declaring class: Magento\Quote\Model\Quote\Address\Total\Collector
[20-Jul-2026 18:38:17 UTC] Parameter: sourceData
[20-Jul-2026 18:38:17 UTC] getType(): NULL
[20-Jul-2026 18:38:17 UTC] Declaring class: Magento\Quote\Model\Quote\Address\Total\Collector
[20-Jul-2026 18:38:17 UTC] Parameter: sourceData
[20-Jul-2026 18:38:17 UTC] getType(): NULL
[20-Jul-2026 18:38:17 UTC] Magento\Quote\Model\Quote\Address\Total\Collector::__construct parameter $sourceData type='\\Magento\\Framework\\Simplexml\\Element'
[20-Jul-2026 18:46:30 UTC] Declaring class: SimpleXMLElement
[20-Jul-2026 18:46:30 UTC] Parameter: data
[20-Jul-2026 18:46:30 UTC] getType(): NULL
[20-Jul-2026 18:47:00 UTC] Declaring class: SimpleXMLElement
[20-Jul-2026 18:47:00 UTC] Parameter: data
[20-Jul-2026 18:47:00 UTC] getType(): NULL
[20-Jul-2026 18:47:00 UTC] SimpleXMLElement::__construct parameter $data type=NULL

please help me understand whether i am doing something wrong or i am missing something.