$ cat writeup.md…
$ cat writeup.md…
hackadvisor
Task: Payment analytics platform with GraphQL API, date filter parameters (fromDate/toDate) passed unsanitized to SQLite query. Solution: Used UNION-based SQL injection through GraphQL fromDate argument to enumerate sqlite_master schema and extract flag from admin_secrets table.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar