Lab 83 — DealStream — UNION SQL Injection in Public Search API

hackadvisor

Task: CRM platform with public search API where the scope parameter is directly interpolated into a SQLite WHERE clause. Flag is XOR-encrypted in admin_settings, decrypted only in admin panel. Solution: UNION-based SQLi to enumerate schema and extract admin reset token, then account takeover via password reset to access admin panel and view decrypted flag.