Url is vulnerable

http://slingogaming.com/slingo_casino_news-story.php?id=-2+UNION+SELECT+1--+

problem is that i found admin panel http://slingogaming.com/admin/account/

and also admin username and email but password filed does not exit

so now i want to upload shell on it

and mysql.user: Host,User,Password also found

so please now how can i upload shell on it OR get .sql Database