hacker.org

Oh yes, the evil thing is the Luxembourg flag which made me think that it got something to do with the telecran magazine. There is an article called "Secret Project Dolphin - revealed" ... I found the etch-a-sketch connection by wikipedia but the Luxembourg flag led me to further investiga...

How did you manage that?

Put the following text in the name field and it exposes the password:
1' UNION ALL SELECT password FROM user/*

Of course this wasn't straightforward and I had to guess the table and column names. It took some time to get there

Guido

I used manual SQL injection attacks and finally managed to get the password published by an MySQL error ("Unknown column 'password' in where clause").

I'm interested in how the used SQL statements look like on the login page.
@adum: Can you post your code here please?

Guido

After trying wget without success I managed to get it with curl.

Guido

Just proved that it is possible to solve it on Windows, too