Sqlite3

Injection in INSERT

drag_indicator

info

drag_indicator

inputs

drag_indicator

inspect

Sometimes the injection can occur in an INSERT statement.

Hints

Hint #1

expand_more

Can you set enabled to something else ?

Hint #2

expand_more

Have you heard of nested queries ?

Read the solution

expand_more

$mail = ', (SELECT password FROM users WHERE username = 'admin')) --

Using nested queries you can SELECT information from the database during an INSERT statement.

note: The columns types in SQLite are not enforced.

drag_indicator

waf

INPUT

OUTPUT

drag_indicator

code

drag_indicator

result