Lab 335 — LeadForge — XPath Injection in XML-Based CRM

hackadvisor

Task: CRM platform using XML file-based data store with contact search feature that interpolates user input directly into XPath expressions. Decoy flags in HTML mislead scanners. Solution: XPath injection via search endpoint — union-based injection to enumerate XML structure, then boolean-based blind extraction using substring() oracle to extract flag from /crm/secret/flag node character by character.