# Level 2: SQL injection vulnerability allowing login bypass

## <mark style="color:purple;">Objective</mark>

This lab contains a SQL injection vulnerability in the login function.

To solve the lab, perform a SQL injection attack that logs in to the application as the administrator user.

## <mark style="color:purple;">Explanation</mark>

The login form is vulnerable to SQL injection due to improper handling of user-supplied input. When credentials are submitted, the application constructs a SQL query that checks if the user exists and if the password matches. By injecting SQL logic into the username field, we can manipulate the query to always return true, effectively bypassing the authentication process and logging in as any user, including the administrator.

## <mark style="color:purple;">Resolution</mark>

1. Go to the **My Account** section to access the login form.
2. In the **Username** field, input the following payload:

```sql
administrator' OR 1=1-- -
```

3. Enter any arbitrary value in the **Password** field (e.g., `test`), since it will be ignored by the SQL logic.
4. The injection transforms the backend query into something like:

```sql
SELECT * FROM users WHERE username = 'administrator' OR 1=1-- -' AND password = 'test'
```

The `OR 1=1` condition always evaluates to true, and the `-- -` sequence comments out the rest of the query.

5. This bypasses the password check and logs you in as the administrator, solving the lab.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcJIZwyH4fpiXpDdlB73wCBcJMyYO44REVxBOD2Er3svix868UW-DER9pS28FTdrEz4_U24mfPKIZ77QEWp0oc9tYwO_WdQuoAqOP2LJXdjrxs34frJx1S_7Em2SWV8rfgHKi3R?key=Ca0b02oypcOIWxBvXZ_03UM1" alt="" width="375"><figcaption></figcaption></figure>

## <mark style="color:purple;">Mitigation</mark>

To prevent SQL injection in authentication functions:

* Always use **parameterized queries** or **ORMs** that safely handle user input.
* Avoid directly embedding input into SQL statements.
* Implement **multi-factor authentication (MFA)** to add an additional layer of security.
* Regularly test login endpoints with automated tools and manual review to detect injection flaws.