CTF Challenges LAB
Five vulnerabilities are hidden in this store. Find them, capture each flag, and submit below. Solved: 0/5
#1 · SQL Injection — Login page
UNSOLVEDBypass authentication on the login form and log in as admin without knowing the password.
Show hint
The login query concatenates your input, but a simple input firewall rejects the most common comment token. SQL supports more than one comment style — try another one.
#2 · Insecure Direct Object Reference — Account / profile page
UNSOLVEDView another customer's private account details and read the admin's private note.
Show hint
After logging in, look at your profile URL. The account reference is encoded rather than a plain number — decode it, tweak it, and re-encode it.
#3 · Stored XSS — Product review section
UNSOLVEDGet JavaScript to execute in the browser of anyone who views a product page.
Show hint
Reviews are rendered as HTML, but <script> tags are stripped out. Other HTML elements can still run JavaScript through event handlers.
#4 · OS Command Injection — Support → delivery status tool
UNSOLVEDRun arbitrary OS commands on the server and read flag.txt.
Show hint
The "Check" tool runs a shell ping. A blacklist blocks one separator and the obvious file-reading commands — there are others it forgot.
#5 · Unrestricted File Upload → RCE — Account → profile picture
UNSOLVEDUpload a web shell and use it to read private/upload_flag.txt.
Show hint
The avatar upload only checks the file's reported content type, not its real contents or its extension. That header is client-controlled.