Lab 51 — InsightGrid — SQL Injection via Django JSONField Key Paths

hackadvisor

Task: Django analytics platform with Custom Report Builder API that passes user-controlled metadata field names to QuerySet.values(), generating unescaped SQL column aliases for JSONField extraction. Solution: exploit CVE-2024-42005 by injecting double quotes into the field name to break out of the AS alias, then use UNION-based SQLite injection with error-based extraction to enumerate tables and read the flag from secret_flags.