Lab 334 — DocuNest — XPath Injection in Knowledge Base Search

hackadvisor

Task: Flask knowledge base with XML-backed search; /search?q= is vulnerable to XPath injection, but @visible attribute filtering in both XPath and app code prevents direct display of hidden articles. Solution: Blind boolean-based XPath injection using union query oracle to enumerate XML structure, locate hidden article 19 containing the flag, and extract it character-by-character via substring().