Authored by nu11secur1ty

Gas Agency Management 2022 suffers from cross site scripting, remote SQL injection, and remote shell upload vulnerabilities.

## Title: Gas Agency Management-2022 by Mayuri K - SQLi+FU-RCE+XSS
## Author: nu11secur1ty
## Date: 08.12.2022
## Vendor Homepage:
## Software Link-0:
## Software Link-1:

## Description:
The Gas Agency Management-2022 by Mayuri K suffers from multiple
vulnerabilities, which means this project must be deprecated

1. - SQLi: the parameter username is vulnerable to time-based blind
(query SLEEP) injection - not sanitizing well.
2. - Unauthenticated file upload - not sanitizing upload function -
possible to upload .php extension files on photo section, for the
3. - XSS-reflected in the section adds customer in address function.
4. - Web shell file upload - unauthenticated extension file upload, in
this case, is PHP web shell uploader. After this, the malicious user
can execute the already uploaded file remotely, and he can destroy
completely this flawed system.
5. - STATUS: For termination of the project.


Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=mxiusQzi'+(select
[+]Unauthenticated Upload:
- - - in the video:

- - - in the video:

- - - in the video:

## Reproduce:

## Proof and Exploit:

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at and
home page:
nu11secur1ty <>