orm-bad
Description
Looking at the source we can see that username needs to be admin
to get the flag.
app.post('/flag', (req, res) => {
db.all("SELECT * FROM users WHERE username='" + req.body.username + "' AND password='" + req.body.password + "'", (err, rows) => {
try {
if (rows.length == 0) {
res.redirect("/?alert=" + encodeURIComponent("you are not admin :("));
} else if(rows[0].username === "admin") {
res.redirect("/?alert=" + encodeURIComponent(flag));
} else {
res.redirect("/?alert=" + encodeURIComponent("you are not admin :("));
}
} catch (e) {
res.status(500).end();
}
})
})
Solution
The query is vulnerable to SQLi. Use --
after admin
to comment out the rest of the query.
This essentially removes the password check.
SELECT * FROM users WHERE username=admin