HackTheBox - Magic

SQLi for login bypass and embed webshell to an image file