webPromedium
Lab 238 — PulseWatch — SQL Injection in Collector Configuration
hackadvisor
Task: Infrastructure monitoring platform with collector configuration; dbhost field is parameterized in INSERT but unsanitized in a secondary SQL query (CVE-2023-49085 pattern). Solution: SQLite string concatenation injection via '||(SELECT ...)||' in dbhost field to enumerate tables and extract flag from system_secrets table.
$ ls tags/ techniques/
sqlitesqliphpnginxstring_concatenationdecoy_flagreflected_sqlicollector_configurationdbhost_injectionsecondary_querycve_2023_49085cacti
decoy_flag_avoidancesqlite_string_concatenation_injectionsecondary_query_sqlischema_enumeration_via_sqlite_masterdata_exfiltration_via_reflected_fieldtime_based_sqli_confirmation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 172 — PulseGuard — Insecure Deserialization via JSON.NET TypeNameHandling— hackadvisor
- [web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor
- [web][Pro]Lab 87 — GridWatch — SQL Injection in Agent Heartbeat API— hackadvisor
- [web][Pro]Lab 84 — PulseView— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor