Account Takeover - Smoking with 'null'

Business Logic Errors - A Logic Destruction

SQL Injection & Remote Code Execution - Double P1