Privesc

Admin creds from the database, command injection in the add-customer form for a shell, then a SUID find for root.

A SQL injection in an invoice search dumped a user table, the password doubled as an SSH login, and a sudo awk entry handed over root.

A client-side filter was the only thing guarding command execution. Past it was a file read to SSH keys, then a SUID gawk for root.