The application processes XML input without proper validation or sanitization

The attacker must gain administrative access to the server

The attacker must disable XML validation on the server

The application must use JSON instead of XML