I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials
admin. The main page does not seem to be vulnerable to SQL injection but the forgot password page is.
Here's the problem, the forget password page only requires
username, and it claims to send a password reset link to the email given. I thought we were supposed to bunch in an
UPDATE query to modify the password of the
admin account so that we can login, but so far, every attempt that I've tried has failed.
Then I read that PHP servers can't bunch together statements, so I'm doubting my general approach now. Could anyone enlighten me on how should I go about this?
The hint given is "the table contains two columns, username and password". But this isn't really helping...?