Medium
SQL Injection
CraftBrew Loyalty sort-order blind injection
A taproom rewards tracker. The sort option reaches ORDER BY unescaped, so UNION won't work here.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
CraftBrew Loyalty tracks pours and rewards points. The leaderboard's sort option (/leaderboard.php?sort=) reaches the query's ORDER BY clause directly.
Goal
Read the value stored in secret_vault.value (that is the flag). The page prints no rows and no errors, so you will have to infer it one answer at a time.