Challenge

A chatbot front end backed by a database.

Solution

The prompt field went straight into a SQL query, so a standard injection through it was enough.