H2 - Java SQL database


You can indicate a non-existent name a of database in order to create a new database without valid credentials (unauthenticated):
Or if you know that for example a mysql is running and you know the database name and the credentials for that database, you can just access it:
Tricks from box Hawk of HTB.

Unauthenticated RCE