Beginner·100 points·24 solves
Meridian Freight — SQL Injection Auth Bypass
Learn how a single quote can walk straight past a login form. You will exploit a classic SQL injection authentication bypass to sign in as an administrator whose password you do not know.
The login runs a query built by pasting your input straight into a SQL string:
SELECT username, is_admin FROM users WHERE username = '<you>' AND password = '<you>'
Because your input becomes part of the query text, SQL syntax you type is executed as SQL. Two levers break authentication: a single quote (') ends the string early so you can inject, OR makes a condition always true, and -- comments out everything after it on the line. The real fix is parameterised queries, where input is data and can never become code.
Your tasks
1
Open the lab and find the login form
Click Open lab. You will see the Meridian Freight portal with a username and password field.
2
Try a normal login
Enter any username and password. It is rejected — the query found no matching row, so no session is granted.
3
Break out of the string
Your username is placed inside single quotes in the query. A single quote in your input ends that string early — everything after it is read as SQL.
4
Comment out the password check
SQL treats -- as 'ignore the rest of this line'. If you comment out the AND password = ... part, only the username decides the result.
5
Log in as admin
Combine the two so the query returns the admin row regardless of the password you type.
6
Capture the flag
The admin dashboard shows the master shipping key. Submit it in the panel to earn your points.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.