Lab 238 — PulseWatch — SQL Injection in Collector Configuration

hackadvisor

Task: Infrastructure monitoring platform with collector configuration; dbhost field is parameterized in INSERT but unsanitized in a secondary SQL query (CVE-2023-49085 pattern). Solution: SQLite string concatenation injection via '||(SELECT ...)||' in dbhost field to enumerate tables and extract flag from system_secrets table.