SQL Injection in Concert Ticket Reservation System 1.0 login.php

This repository is a small proof-of-concept demonstrating a simulated container escape via symlink abuse on a shared volume, labeled as CVE-2026-5555. It contains three code files: a Bash helper (compile_host_escape.sh) that creates a world-writable shared directory at /tmp/shared_volume, a host-side Python simulator (vulnerable_container_engine.py) that continuously appends log data to /tmp/shared_volume/app.log, and an attacker-side Python script (exploit_container_escape.py) that creates a symlink named app.log in the shared directory pointing to /etc/host_passwd. The intended effect is that the host process follows the symlink and writes into the attacker-chosen host file. The README explains the attack as a /proc/self/fd-based symlink/container escape through an rshared-mounted volume, but the actual code is a simplified local simulation and does not implement real namespace or procfs escape mechanics. There are no network capabilities or remote endpoints in the exploit logic; the attack is local/container-based and relies entirely on filesystem interactions. Overall, the repository’s purpose is educational/demonstrative rather than operational, showing the core overwrite primitive behind a host file clobbering container escape scenario.