Lab 79 — LeadStream — Blind SQL Injection via Excel Bulk Import

hackadvisor

Task: CRM platform with XLSX bulk import feature; email field in uploaded spreadsheet is interpolated into SQLite query without parameterization. Solution: boolean-based blind SQLi via duplicate detection oracle — inject conditions into email cells, use binary search with unicode(substr()) to extract flag from admin_secrets table.