Medium
SQL Injection
BookNook search (SQL injection)
AD
I
2
A bookshop search puts your query straight into SQL; UNION your way to a secrets table.
PentestingHere Academy
Official Academy lab
- Attempts
- 6
- Solves
- 5
- Published
- 6 Sep 2026
Scenario
BookNook lets you search books by title at /search.php?q=. The page even shows you the
SQL it runs.
Goal
Read the value stored in the secrets table and submit it as the flag. The search results
show three columns per row (title, author, year).