When we visit the website, we can see that we need to provide `object` parameter which is base64 encoded JSON object.
Just for my convenience I decided to use JSON beautifier, but it quickly appeared that it also bypasses the WAF protection.
Then the challenge became an easy SQL injection task.
First we need to get tables names.
```
{
"data": "' union select 1,group_concat(table_name) from information_schema.tables where table_schema!='information_schema'#"
}
```
It reveals that we have 3 tables: access_logs, credentials, news. We can easily dump all data from these tables using the same trick.
There is only one user - `valid_user`. Password hash in hex is 32 digits, so we know that it's probably MD5. We can easily crack the hash as the password is just `password`. The last thing we have to do is to find login panel. To do this we can simply analyse access_logs table, where we can find that someone accessed
`/?action=log-in`. When we visit this link we can see that it requires us to pass credentials array.

http://167.99.12.110/?action=log-in&credentials[0]=valid_user&credentials[1]=password

The flag is: ASIS{e279aaf1780c798e55477a7afc7b2b18}