Over the weekend, the sixth edition of the DownUnderCTF capture-the-flag competition was held. I (hashkitten) contributed a single hard web challenge called ‘legendary’, which was solved by a single team. As part of the challenge, you had to exploit a seemingly impossible SQL injection, where everything was escaped correctly and PHP PDO prepared statements were used. The solution leverages a little-known technique, which I believe to be novel, and allows for injection in otherwise unexploitable scenarios. This technique is the subject of this blog post.
