BugBountyHunter

while trying to login into the vaccination manager page, i tried sql injection, and to my surprise it worked

1. now we know that there's an admin user, so we type in username admin but in password we try some sql commands ( ' or 1=1# ) in password and we get this error

2. send the request to repeater and try the payloads there

notice that now we have a redirect BUT there's a vaccination manager cookie set, if i follow the redirection in burp it'll take me to the login page, but all i need is the cookie

3. open f12 on login.php enter the cookie values manually like so:

navigate to vaccination-manager/portal.php and you're in

so sql injection worked