# Findings Journal

*Auto-generated during engagement "northgate-freight"*

---

## !!! [CRITICAL] OS Command Injection in tracking form (tracking param -> ping)
**Time**: 2026-08-11T06:41:18.865Z
**Host**: 77.91.123.159:80
**Status**: confirmed
**Description**: The tracking form POST parameter 'tracking' is passed unsanitized into a ping command. Injection via ';cmd' executes arbitrary commands as www-data (uid=33).
**Evidence**: `POST tracking=;id -> <pre>uid=33(www-data) gid=33(www-data) groups=33(www-data)</pre>`
---

## Access Gained: 77.91.123.159
**Time**: 2026-08-11T06:41:21.609Z
**Type**: rce
**User**: www-data
**Level**: user
**Details**: Command injection via POST tracking parameter on index.php (ping wrapper)
---

## Credential Found: svc_sync@northgatefreight.ca
**Time**: 2026-08-11T06:42:32.308Z
**Type**: password
**Source**: /opt/routewatch/sync_agent.conf on 77.91.123.159 (base64-encoded secret)
**Valid For**: northgatefreight.ca, 45.92.170.247
**Domain**: northgatefreight.ca
---

## Credential Found: edi_admin
**Time**: 2026-08-11T06:42:36.068Z
**Type**: password
**Source**: /var/www/html/config.php.bak on 77.91.123.159 (marked LEGACY/superseded SEC-114)
**Valid For**: mysql? 10.20.0.14
---

