I got the exploit and (I believe) finished the challenge but I have no idea on how to get the flag 
No tools used right now, I’m doing all manually + nodejs coding.
solved! thx to @daverules for the help , I’ve learnt something new about queries
<img src=“https://www.hackthebox.eu/badge/image/137749”; alt=“Hack The Box”>