<?xml version="1.0" encoding="ISO-8859-1"?>
<pentest_database>
<pentest_user>
<username>admin</username>
<password>123456</password>
<account>Administrator</account>
</pentest_user>


<pentest_user>
<username>pentest</username>
<password>123456</password>
<account>User</account>
</pentest_user>

<pentest_user>
<username>pentestprojects</username>
<password>pass123</password>
<account>User</account>
</pentest_user>

</pentest_database>

<?php

$login = simplexml_load_file("user.xml");

if(isset($_POST['uname'])&&isset($_POST['pass'])){
$u=$_POST['uname'];
$p=$_POST['pass'];

$netice=$login->xpath("(//pentest_user[username/text()='".$u."' and password/text()='".$p."']/account/text())");

}

if(isset($netice)&&$netice==true){

echo "Xosgeldin ".$login->pentest_user->username;


die();
}
?>

<form action="" method="POST" >
<h1>PuN!Sh3r Xpath injection bypass auth</h1>
<pre><strong>Username:<br><input type="text" name="uname" ><br>
Password:<br><input type="text" name="pass" ><br>
<br><input type="submit" value="Daxil ol" >



</form>