From SQLi to Full Server Takeover 🎯 A Web App CTF Breakdown

👋 Intro

I recently worked through a grey-box web application CTF hosted atctf.u16.online, and it turned out to be a great chained-exploitation exercise. What started as a simple SQL injection in a search bar ended with a reverse shell on the box. 🐚

In this writeup, I'll walk through each vulnerability I found, how I chained them together, and what the underlying root causes were — five findings in total, ranging from Insecure Direct Object References all the way up to unauthenticated-to-root-shell RCE.

Stack rank of what's coming:

• 💉 Union-based SQL Injection → leaked admin creds
• 📤 Unrestricted File Upload → Remote Code Execution
• 🖥️ OS Command Injection → 3 separate entry points
• 🐚 Command execution via an uploaded web shell
• 🔓 IDOR → read any user's profile, including the admin's

Let's get into it.

💉 1. Union-Based SQL Injection

Severity: High | CVSS 8.8

The post search feature (/posts/search?q=) passed my input straight into a SQL query with no sanitization. Classic setup for a UNION-based injection.

First step — figure out the table layout:

' union select 1, group_concat(table_name), 3, 4 from information_schema.tables where table_schema = database() and 1=1 -- -

' union select 1, group_concat(table_name), 3, 4 from information_schema.tables where table_schema = database() and 1=1 -- -

Then the columns:

' union select 1, group_concat(column_name), 3, 4 from information_schema.columns where table_schema = database() and 1=1 -- -

' union select 1, group_concat(column_name), 3, 4 from information_schema.columns where table_schema = database() and 1=1 -- -

Once I had the schema mapped out, I pulled the CTF flag and the administrator's stored credentials directly from the database. 🗝️

That admin password unlocked everything else in this write-up.

📤 2. Remote Code Execution via Unrestricted File Upload

Severity: Critical | CVSS 10.0

Logged into the admin panel with the creds from the SQLi. 🔑 Straight away I found a file upload endpoint with zero validation — no extension check, no MIME check, no content inspection. Nothing.

So naturally, I uploaded a PHP reverse shell and hit it directly in the browser.

nc -lvnp 4444

nc -lvnp 4444

Got a callback immediately:

Full remote code execution, no further exploitation required. This one finding alone would justify a Critical rating — an unauthenticated file-type check is about as bad as it gets. ⚠️

🖥️ 3. OS Command Injection — Three Different Entry Points

Severity: Critical | CVSS 9.8

While poking around the admin panel's "System Health Checks" page, I noticed it had a denylist blocking commands like cat, ls, wget, curl, nc, bash, sh, and exec. 🚫

Cute — but the ; command separator was never filtered. So I just chained a different command after it.

Ping tool:

8.8.8.8; more /etc/passwd

8.8.8.8; more /etc/passwd

API health check + database host field, same trick:

api:5000/health;cat /etc/passwd
db;cat /etc/passwd;

api:5000/health;cat /etc/passwd
db;cat /etc/passwd;

Denylists are a losing game — all it takes is one unblocked metacharacter and the whole filter is irrelevant. 🧨

🐚 4. Command Execution via an Uploaded Web Shell

Severity: High | CVSS 8.6

(Originally logged as "LFI" — but on review this isn't file inclusion at all, it's straightforward command execution through a parameter on a web shell I'd already uploaded. Worth calling out, since mislabeling a finding can undersell — or oversell — the actual risk.)

Using the same broken upload functionality from Finding 2, I dropped a small PHP web shell that accepts commands via a cmd parameter:

/uploads/webshell.php?cmd=id

/uploads/webshell.php?cmd=id

Running as www-data, but still full command execution on demand — no reverse shell needed for quick recon.

🔓 5. IDOR on the Profile Endpoint

Severity: High | CVSS 7.5

Last one — the profile endpoint trusted a client-supplied user_id with no ownership check whatsoever.

GET /profile?user_id=3

GET /profile?user_id=3

Swapping the ID handed back another user's full profile — email, username, and an is_admin flag — no authorization check in sight. A textbook IDOR. 🕳️

🧠 Root Cause & Takeaways

Zooming out, every one of these findings traces back to the same underlying habit: trusting client input.

• 🚫 No parameterized queries → SQL injection
• 🚫 No file-type/content validation → arbitrary upload → RCE
• 🚫 Denylist instead of allowlist → command injection bypass
• 🚫 No server-side ownership check → IDOR

And they chain beautifully for an attacker: SQLi → admin creds → file upload → RCE. One weak link at the front of the chain is often enough to compromise the whole app.

Fixes that would've stopped this dead:

• ✅ Parameterized/prepared statements everywhere
• ✅ Allowlist file validation (extension + MIME + magic bytes) + no execute permissions on upload dirs
• ✅ Never pass user input to a shell — use native APIs instead of shelling out
• ✅ Server-side authorization checks on every object reference

✍️ About Me

I'm Mohamed Mahmoud Metwally, a Computers & Control Systems Engineering graduate and aspiring penetration tester, currently building out my offensive security portfolio. If you enjoyed this breakdown, I write these up as I work through CTFs and labs — feel free to follow along. 🚀

Thanks for reading!