Attributes

XPATH is not only texts

With XPATH you can also query attributes. In this XML database the role on an user if store as an attribute on the user node.

Try to find the user with role="ADMIN" and get its password.

Goal: find the admin and leak its password