webhard

SQLAlchemist

miptctf

Flask + SQLAlchemy app with recursive JSON-to-object attribute setter. Exploit SQLAlchemy ORM internals by manipulating __mapper__.local_table.name to swap table target and _sa_instance_state.committed_state to control dirty tracking, resulting in UPDATE note SET user_id=2 WHERE id=1 to steal admin's flag note.

$ ls tags/ techniques/
flaskpythonprototype_pollutionsqlalchemyormarbitrary_setattr
sqlalchemy_mapper_manipulationcommitted_state_injectiontable_name_swaporm_dirty_tracking_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]