# NimbusPay — SQL Injection Auth Bypass (CTF challenge)

> NimbusPay's internal admin portal was rushed to production. The login form talks to the users table 'the quick way'. Standard accounts reveal nothing — the master key is only on the admin dashboard.

Canonical: https://codelivly.com/ctf/challenges/nimbuspay-sqli

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Easy |
| Points | 100 |
| Estimated time | 20 min |
| Type | Live instance |
| Solves | 53 |
| Author | Codelivly |

NimbusPay's internal admin portal was rushed to production. The login form talks to the users table 'the quick way'. Standard accounts reveal nothing — the master key is only on the admin dashboard. Authenticate as admin without the password.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)