NewsDesk — Article archive

Scenario

NewsDesk's article viewer looks up rows by id from the query string. Errors from the database sometimes echo back to the page. Recover credential material stored in the users table.

Your approach

1. Request a valid article id, then probe with a quote to trigger an error.
2. Count columns with ORDER BY or UNION probes until the query succeeds.
3. Union-select username and password fields from the users table.
4. Read the admin password or flag value from the rendered result.
5. Submit that recovered secret as your answer.