XPath is what happens when XML guys get jealous of SQL and invent their own query language too. The good news (for hackers) is that XPath has an all-or-nothing connotation, if you get some access, you get it all! Sorry XML people, this is what happens when you try to make a standard do too much. XPath, unlike SQL, lacks granular access control, so there are no tiers of privilege to navigate between, and if you can enumerate one character, you know you are able to capture all of them. Hopefully these tradeoffs are understood by our target's developers, and protection via other means is put into place to prevent access or validate all transactions.
XPath injections are pretty straightforward once you have that basis in SQLI. ...
