webPromedium

Fragment XML

web-kids20

Web application for processing payments. The system validates that the sender equals "me" — you cannot pay from someone else's account. User input in the "comment" field is inserted into the XML document without escaping.

$ ls tags/ techniques/
xmlinjectionpayment_bypassfragment_injection
xml_fragment_injectionpayment_forgery
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups