$ grep -r "cron"
A ticket-booking site leaks files through an unauthenticated arbitrary file read on its /download endpoint. A second vHost running Gitea reveals a docker-compose bind mount, which we use to read the Gitea config and pull its SQLite database off disk. Cracking the developer PBKDF2 hash gives SSH access, and a root cron running a vulnerable ImageMagick (CVE-2024-41817) with an empty LD_LIBRARY_PATH is abused with a malicious shared library for root.
A file-upload form validates image extension and MIME magic bytes but permits a PHP double extension, which an Apache handler misconfiguration executes, yielding a shell as www-data. A cron job running as guly passes uploaded filenames unsanitised to exec(), so a filename containing shell metacharacters achieves command injection and a shell as guly. guly may run a network-configuration script as root that reads interface values into a config file, and a known ifcfg script-injection flaw turns those values into root command execution.