Cat is a medium-difficulty Linux machine featuring a custom PHP web application vulnerable to XSS, which allows cookie hijacking and privilege escalation. A SQL injection in a SQLite database enables remote code execution and access to internal logs, which leak plaintext credentials. These are used to access a vulnerable Gitea instance (CVE-2024-6886), ultimately leading to the discovery of root credentials in a private repository.
