$ cat writeup.md…
$ cat writeup.md…
miptctf
Flask + SQLAlchemy app with recursive JSON-to-object attribute setter. Exploit SQLAlchemy ORM internals by manipulating __mapper__.local_table.name to swap table target and _sa_instance_state.committed_state to control dirty tracking, resulting in UPDATE note SET user_id=2 WHERE id=1 to steal admin's flag note.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar