The "Welcome back!" message forms a one-bit SQL oracle for predicates injected through TrackingId. Length checks establish a 20-character password, and SUBSTR comparisons recover the administrator value one character at a time.
Oracle EXTRACTVALUE and XMLType place the administrator password into a Collaborator subdomain requested by the database. The resulting DNS lookup carries the secret even though the application response contains no query output.
The proof arrives outside the HTTP response: the in-band response is unchanged, but EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual causes a Collaborator DNS interaction.
The page content remains unchanged, but a PostgreSQL payload containing pg_sleep(10) delays the response by ten seconds. That repeatable timing difference proves the TrackingId cookie reaches an executable SQL context.
The database exposes values through latency rather than response content. CASE WHEN with pg_sleep(10) establishes a 20-character password, and SUBSTRING comparisons recover each character from the administrator credential.
A two-column UNION query identifies PostgreSQL through version() and enumerates information_schema.tables to find users_occukb. Querying information_schema.columns then reveals username_gfkpyb and password_xrdklp for credential extraction.
The injectable category filter supports a two-column Oracle UNION query that enumerates all_tables and finds USERS_GSEMNG. Querying user_tab_cols reveals USERNAME_RKTXFE and PASSWORD_YCJIMQ, which return the administrator credential.
Oracle requires each UNION branch to select from a table, so adding FROM dual makes the two-column probe succeed. Rendering banner from v$version in the text-compatible column then identifies the database release.
Rendering version() through a two-column UNION exposes the MySQL banner in the category results. A Microsoft SQL Server probe would use @@version, so the returned text and accepted syntax distinguish the platforms.
ORDER BY 3 succeeds while ORDER BY 4 fails, establishing that the original query returns three columns. UNION SELECT null,null,null confirms the result shape with a compatible all-null row.
Only one UNION position can carry the required string: placing yNBXRx in column one errors, while UNION SELECT null,'yNBXRx',null displays it in column two. The visible yNBXRx value identifies column two as text-compatible.
ORDER BY 2 succeeds and ORDER BY 3 fails, proving that the product query returns two columns. UNION SELECT username,password FROM users renders both credential fields and exposes the administrator login.