We used the SELECT function in MySQL with a '-' between the || operators and sent the request. This allowed us to see the username and password values output in a single response, separated by -:
'+UNION+SELECT+NULL,username||'-'||password+FROM+users--
After sending the request and receiving the output, we used the credentials to log in as administrator and successfully solved the lab:
