This whitepaper details some novel methods of exploiting blind XPath 2.0 injection flaws that can be used to retrieve the whole document being queried (and others on the filesystem) without needing a large number of requests. It also covers exploiting some common XML databases.
You can download it from the following link: https://packetstormsecurity.com/files/download/124727/bh-eu-12-Siddharth-Xpath-WP.pdf
Source: https://packetstormsecurity.com/files/124727/Hacking-XPath-2.0.html