Multiple vulnerabilities in SugarSales
SugarSales is affected by multiple vulnerabilities including an SQL injection vulnerability, a directory traversal vulnerability, and a remote denial of service and information disclosure vulnerability. The SQL injection vulnerability is caused by a lack of input validation, allowing attackers to inject malicious SQL queries. The directory traversal vulnerability is also due to a lack of input validation, enabling attackers to access files outside the intended directory. The remote denial of service and information disclosure vulnerability allows attackers to access sensitive information and cause a denial of service. To exploit these vulnerabilities, an attacker can log into SugarSales using the username 'admin' or '1=1 --' with any password. Additionally, sensitive files can be disclosed by accessing specific URLs.
