$ grep -r "sql-injection"
A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.
A blog's password-reset form is vulnerable to SQL injection, which dumps and cracks the admin bcrypt hash. The admin panel runs a vulnerable Laravel-admin (CVE-2023-24249) whose avatar upload is bypassed by tampering the multipart filename in Burp to land a PHP webshell, giving a shell as dash. A reused password in dash's .monitrc grants SSH as xander, who can run a custom root binary that invokes 7-Zip with an unquoted wildcard; a crafted @-listfile symlink leaks root's private SSH key.
Default credentials open a vulnerable Tiny File Manager (CVE-2021-45010), whose writable uploads directory gives a PHP reverse shell as www-data. The nginx config reveals a soc-player vhost vulnerable to a WebSocket-based blind SQL injection, which dumps SSH credentials for player. A doas rule allowing dstat is abused with a malicious Python plugin to spawn a root shell.
A GraphQL API on port 3000 leaks HelpDeskZ credentials through introspection; the cracked password logs us into the help desk, whose unauthenticated arbitrary file upload yields a reverse shell. An outdated kernel is then exploited with CVE-2017-16995 for root.