← all rooms
SQL Injection
Hard
Second-Order SQLi
Store a payload in your bio, trigger it in admin search.
Mission briefing
TalentBoard lets users edit profile bios stored for later admin review. An internal search tool later queries those bios with string concatenation. Plant input that stays harmless on save but triggers when an admin searches.
0 / 1 tasks
0 / 15 pts
Room cleared
Every task in this room is done. Your rank progress just moved forward.
Objectives
- Land a second-order injection
Task 1 Stored then triggered Hard 15 pts
Scenario
TalentBoard stores your profile bio verbatim for later admin searches. The admin search tool builds a query by concatenating your stored text. Save a bio that stays quiet on edit but alters the search query when reviewed.
Your approach
- Update your bio with a payload containing SQL syntax and save it.
- Trigger the admin search feature against your username or bio text.
- Observe extra rows or error output indicating injection fired.
- Copy the second-order flag from the search results page.
- Submit that flag.
Poison bio, then run search.
Open lab →Hint
' UNION SELECT username, bio FROM profiles--