← Back to Writeups
CUSTOMEasyWeb
Bookmark

level30

XESXOR9/10/20261 min read
#web#custom#easy#like_clause_injection#union_based_sqli

level30

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: like_clause_injection, union_based_sqli

Summary

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level30/

level30 — Web Kids 2.0

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level30/

Analysis

The application uses a LIKE clause in the SQL query for search functionality. The user input is directly concatenated into the LIKE pattern, allowing for UNION-based SQL injection by escaping the LIKE clause context.

Key vulnerability: Input is placed inside a LIKE clause without proper sanitization, allowing injection after closing the pattern.

Solution

UNION-based injection in LIKE clause: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  1. Close the LIKE pattern with %'
  2. Add UNION SELECT to extract data from other tables
  3. Comment out the rest of the query

Example payload:

 sql 
%' UNION SELECT flag FROM flags--

Or with column matching:

 sql 
%' UNION SELECT 1,flag,3 FROM flags--

The injection point is within the LIKE clause, so we need to properly escape it first before adding our UNION statement. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍