AeroCMS v0.0.1 front-end search function sql Injection vulnerability

[onekingcc]

Vulnerability Details： AeroCMS v0.0.1 found that it is possible to include sql injection through the search parameter in the search.php file. This vulnerability allows an attacker to gain database administrator privileges and access database information without authentication.

It can be found in lines 19-22 in search.php that the parameters passed in by the user are directly spliced ​​to cause like injection

Vulnerability recurrence： poc: %1'and updatexml(1,concat(0x7e,database(),0x7e),0)#