webProhard

SQLAlchemist

miptctf

Flask + SQLAlchemy app with recursive JSON-to-object attribute setter. Exploit SQLAlchemy ORM internals by manipulating __mapper__.local_table.name to swap table target and _sa_instance_state.committed_state to control dirty tracking, resulting in UPDATE note SET user_id=2 WHERE id=1 to steal admin's flag note.

$ ls tags/ techniques/
flaskpythonprototype_pollutionsqlalchemyormarbitrary_setattr
sqlalchemy_mapper_manipulationcommitted_state_injectiontable_name_swaporm_dirty_tracking_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups