I realised it was SQL injection with MongoDB. I reasearched a bit and came across [this answer](https://security.stackexchange.com/a/83234). I tried the payload that was shown in the example: `'; return '' == '` as password and admin as username.
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/977a2410-a336-4281-bc20-d0fbc14eb916)
AND IT WORKED!
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/6f511a10-c541-40e4-9f3f-e6a946db50e2)
Flag: `flag{easier_than_picture_lab_at_least}`