After extensive research and consulting the SQL Injection Fundamentals note from Hackthebox academy, we discovered a payload for finding the column count using Union injection in MySQL. We then used this payload with Burp Repeater and confirmed that there are two columns :
We then utilized @@version to query the version of the MySQL database, ultimately resolving the lab :
Note: The official solution to this lab highlighted an alternative commenting method using # instead of -- - to comment out the remaining part of the query more conveniently.
