Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
**Describe the bug**
An unsanitized collType parameter can be used to perform bloolean base blind SQL Injection attack

**To Reproduce**
1. Log in as admin
2. go to http://localhost/admin/modules/reporting/customs/loan_by_class.php?reportView=true&year=2002&class=bbbb&membershipType=a&collType=aaaa
3. capture the request and save it to a file
4. use sqlmap with this command `sqlmap -r <capture_http_req >.req--level 5 --risk 3 --dbms=mysql -p collType --technique=B --current-user`

**Screenshots**
1. bredel.req

![image](https://user-images.githubusercontent.com/46653986/196041082-240ad035-15df-42b3-9bc8-503d17122ca5.png)

2. sqlmap first run without getting anything from the database

![image](https://user-images.githubusercontent.com/46653986/196041133-1332aa68-75c6-4dc2-bc92-eef782a13255.png)

3. sqlmap get current user

<img width="1440" alt="Screen Shot 2022-10-16 at 21 22 47" src="https://user-images.githubusercontent.com/46653986/196041256-dd9524f4-5ee9-4ca9-82d0-dca8c2867b79.png">


**Versions**
- OS: Kali Linux(Debian) 2021
- Browser: Firefox 78.7.0.esr(64-bit)
- Slims Version: slims9_bulian-9.4.2

[Security Bug] Boolean SQL Injection in loan_by_class.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bug] Boolean SQL Injection in loan_by_class.php
Issue date:

--- start body ---
**Describe the bug**
An unsanitized collType parameter can be used to perform bloolean base blind SQL Injection attack

**To Reproduce**
1. Log in as admin
2. go to http://localhost/admin/modules/reporting/customs/loan_by_class.php?reportView=true&year=2002&class=bbbb&membershipType=a&collType=aaaa
3. capture the request and save it to a file
4. use sqlmap with this command `sqlmap -r <capture_http_req >.req--level 5 --risk 3 --dbms=mysql -p collType --technique=B --current-user`

**Screenshots**
1. bredel.req

![image](https://user-images.githubusercontent.com/46653986/196041082-240ad035-15df-42b3-9bc8-503d17122ca5.png)

2. sqlmap first run without getting anything from the database

![image](https://user-images.githubusercontent.com/46653986/196041133-1332aa68-75c6-4dc2-bc92-eef782a13255.png)

3. sqlmap get current user

<img width="1440" alt="Screen Shot 2022-10-16 at 21 22 47" src="https://user-images.githubusercontent.com/46653986/196041256-dd9524f4-5ee9-4ca9-82d0-dca8c2867b79.png">


**Versions**
- OS: Kali Linux(Debian) 2021
- Browser: Firefox 78.7.0.esr(64-bit)
- Slims Version: slims9_bulian-9.4.2

--- end body ---

The issue describes a Boolean-based blind SQL Injection vulnerability in the loan_by_class.php file of the Slims application. The collType parameter is unsanitized, allowing an attacker to manipulate SQL queries and potentially extract sensitive information from the database. This vulnerability can be exploited by capturing HTTP requests and using tools like sqlmap to perform the injection, as demonstrated in the reproduction steps.