Apprentice
← back to room
SQL Injection

Second-Order SQLi

Scenario

TalentBoard stores your profile bio verbatim for later admin searches. The admin search tool builds a query by concatenating your stored text. Save a bio that stays quiet on edit but alters the search query when reviewed.

Your approach

  1. Update your bio with a payload containing SQL syntax and save it.
  2. Trigger the admin search feature against your username or bio text.
  3. Observe extra rows or error output indicating injection fired.
  4. Copy the second-order flag from the search results page.
  5. Submit that flag.
1) Save a malicious bio (injection stays stored). 2) Run admin search — it concatenates your stored bio into SQL. Try bio: ' UNION SELECT username, bio FROM profiles--

Update your bio (player)

Admin search (uses your stored bio)

Profiles

('admin', 'safe bio')
('player', 'hello')