12 lines
445 B
Plaintext
12 lines
445 B
Plaintext
|
Micro-CMS v2
|
||
|
|
||
|
= flag 1 =
|
||
|
Used a ' to find out the login page is vulnerable to [[SQLi]] however it returns an error. Using '1='1 returns password error, rather than SQL error. We can use this
|
||
|
Then use union to set the password to whatever you want and exploit with the previous code. the payload to log in:
|
||
|
'UNION SELECT '123' as password from admins where '1'='1
|
||
|
|
||
|
Quotes matter! using "123" instead of '123' lead to an SQL error.
|
||
|
|
||
|
= flag 2 =
|
||
|
|