Catalogue filter
Filter the catalogue by the pinned term. A keyword blocklist strips union and select.
Catalogue
#1 · CSPSHIVAM Hoodie · $49 (apparel)
#2 · Sticker Pack · $6.5 (apparel)
#3 · CTF Coffee Mug · $14 (drinkware)
#4 · Yubikey Clone (toy) · $25 (hardware)
#5 · 1U Rack Server (used) · $320 (hardware)
Filter catalogue
Blocklist runs once, then the query executes.
The injectable value is pinned by the page — tamper it with an intercepting proxy.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.