Lab 81 — InsightPulse — SQL Injection in Analytics Tracking

hackadvisor

Task: InsightPulse web analytics dashboard with /api/track endpoint that stores visitor User-Agent header directly into SQLite via string concatenation in INSERT statement. Solution: Stored SQL injection via User-Agent header using subquery injection to enumerate sqlite_master, discover platform_secrets table, and extract the flag.