sqlmap

Part of Incognito CTF. A clever box, rated medium, with a simple but effective route to root. Probably about the right level