Plfanzen 2026

Web challenge writeups from Plfanzen 2026 — JavaScript-flavoured server-side logic bugs: node-sqlite3 array-binding parameter pollution, missing-await bcrypt, case-insensitive LIKE, and a LiquidJS sort_natural prototype-leak side-channel.

0 categories 1 note

Notes

1 total

Thank You Javascript — sqlite3 array-binding + missing-await bcrypt → LiquidJS sort_natural prototype leak

Register with email as an array so node-sqlite3 shifts bindings and leaves verification_code NULL (auto-verified). A missing await on bcrypt.compare plus a case-insensitive LIKE lets ADMIN reset the real admin's password. Then CVE-2026-39412 (LiquidJS sort_natural) leaks the prototype-hidden flag via a sorting side-channel.

web web-server nodejs express node-sqlite3 array-binding +18