XML injection (aka Blind Xpath injection)