XML feedback endpoint
Feedback is submitted as an XML document; the server parses it and echoes your
<message> back. The endpoint reads the raw request body when it arrives as
application/xml.
Expected body (Content-Type: application/xml)
<?xml version="1.0"?>
<feedback><message>Great labs!</message></feedback>
This box wraps your message into a fixed, escaped document. Controlling the XML itself — to declare an entity — means sending the raw body yourself.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.