I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page.
For example XML file looks like this:
<?xml version="1.0" encoding="utf-8"?> <Request xmlns="http://www.w3.org/1.0"> <Body CaseId="Test/123656"> <person gender="female"> <note date="2008-01-10"> </Body> </Request>
The value of CaseID, gender and date is than presented on another page. Is it possible to send somehow XSS payload in attribute value if web application blocks "<"? I would like to test also XXE, is it possible to reference to external entity in attribute value?