PostgreSQL database not accepting edits

[zerodayhacker]

Hi,
In Challenge 13, I have found the coupon_code parameter in the /workshop/api/shop/apply_coupon to be injectable.
I also found the applied_coupon table in the PostgreSQL database.

The endpoint accepts the following injection and returns the database version:
"coupon_code":"TRAC075'; SELECT version() --+"

But it refuses the following and returns a 500 error:
"coupon_code":"TRAC075'; DELETE FROM applied_coupon WHERE coupon_code=TRAC075 --+"

Is there anything that needs to be changed in the crAPI config file to allow user edits to be made to the database? I noticed there are restrictions for shell injection.

Thanks,
Edw.

[siddharthkarn2212]

This behavior looks intentional.

crAPI is designed as a vulnerable API lab, but destructive database
operations (INSERT/UPDATE/DELETE) are typically restricted to avoid
breaking the lab state.

Allowing read-only SQL injection (e.g., SELECT version()) demonstrates
the vulnerability without allowing permanent data modification.

Unless the goal is to demonstrate data tampering vulnerabilities,
blocking DELETE statements is expected behavior and not a misconfiguration.