Lab 267 — RestForge — SQL Injection in Dynamic Data Endpoint

hackadvisor

Task: RestForge auto-generates REST endpoints from PostgreSQL; /api/data/:schema/:table has unsanitized table path parameter. Solution: UNION-based SQL injection with type casting to bypass application-level schema access control and extract flag from admin.internal_secrets table.