Lab 82 — PixelVault — SQL Injection via User-Agent in Activity Logging

hackadvisor

Task: Photo management platform with activity logging that stores User-Agent header directly in MariaDB via non-parameterized INSERT. Decoy flags in HTML comments mislead scanners. Solution: Time-based blind SQL injection via User-Agent header during login, using IF(condition, SLEEP(), NULL) in the datetime column of the INSERT statement, binary search extraction of flag from app_secrets table.