Hacker101 CTF: Micro-CMS v2 - Part 1

This is the third challenge. Difficulty level is set to moderate and we need to find three flags.

The first thing I did was click on Micro-CMS Changelog. What it mentioned is "users need to be an admin to add or edit pages now." When I tried to edit, it took me to the login page. Ofcourse, no credentials were provided and we have to find a way around this. This is where the SQL injection could come in handy. I tried with very simple case of SQL injection

abc' OR '1' = '1 with some random password abc. This gave an error: "invalid password".

I looked for the hint at this point of time. First hint was "Regular users can only see public pages". This means to get the flag I need to get through this login page and access page which is not listed in public above. But still I couldn't figure out the mechanism to get through. So took another hint, which was "Getting admin access might require a more perfect union". Here it was the clue. I need to use the union operator to break this system. I tried following

username: bar' UNION SELECT "aaa" as password FROM admins where '1' = '1

password: aaa

Login was successful

There is private page now listed in the page. When I clicked there... Voila! the flag :D

I also took the last hint even though the things were done. It said
Knowing the password is cool, but there are other approaches that might be easier