Gas Agency Management 2022 SQL Injection / XSS / Shell Upload

CVE Category Price Severity
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Not specified High
Author Risk Exploitation Type Date
Not specified High Remote 2022-08-14

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Gas Agency Management 2022 SQL Injection / XSS / Shell Upload
## Title: Gas Agency Management-2022 by Mayuri K - SQLi+FU-RCE+XSS
## Author: nu11secur1ty
## Date: 08.12.2022
## Vendor Homepage:
## Software Link-0:
## Software Link-1:

## Description:
The Gas Agency Management-2022 by Mayuri K suffers from multiple
vulnerabilities, which means this project must be deprecated

1. - SQLi: the parameter username is vulnerable to time-based blind
(query SLEEP) injection - not sanitizing well.
2. - Unauthenticated file upload - not sanitizing upload function -
possible to upload .php extension files on photo section, for the
3. - XSS-reflected in the section adds customer in address function.
4. - Web shell file upload - unauthenticated extension file upload, in
this case, is PHP web shell uploader. After this, the malicious user
can execute the already   uploaded file remotely, and he can destroy
completely this flawed system.
5. - STATUS: For termination of the project.


Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=mxiusQzi'+(select
[+]Unauthenticated Upload:
- - - in the video:

- - - in the video:

- - - in the video:

## Reproduce:

## Proof and Exploit:

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at and
home page:
                          nu11secur1ty <>

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.