FeMiner WMS SQL Injection Vulnerability

A SQL injection vulnerability has been identified in FeMiner WMS version 1.0. This vulnerability allows remote attackers to access sensitive information by injecting malicious SQL into the 'date1', 'date2', and 'id' parameters of the 'inquire_inout_receipt.php' script.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, send a request to '/test/inquire_inout_receipt.php' with the 'option' parameter set to 'date' or one of several other options, and inject a SQL payload into the 'date1', 'date2', or 'id' parameters. The injected SQL payload can include commands such as 'SELECT' combined with 'SLEEP' to demonstrate the injection.