CVE-2021-38840

This exploit leverages a SQL injection to bypass authentication and an unrestricted file upload vulnerability to achieve remote code execution (RCE) in Simple Water Refilling Station Management System 1.0. It uploads a PHP shell and triggers a reverse shell payload based on the target OS.

This exploit demonstrates an SQL injection vulnerability in the Simple Water Refilling Station Management System 1.0, allowing authentication bypass via a crafted POST request. The payload manipulates the username parameter to bypass login controls.