sql injection vulnerabilities in Best Free Law Office Management Software（add_act.php）

sql injection vulnerabilities in Best Free Law Office Management Software
Explaination:
SQL injection errors occur when:
Data enters a program from an untrusted source.
The data is used to dynamically construct a SQL query.
 
Target Code source:
https://www.mayurik.com/source-code/P5339/best-free-law-office-management-software

Url:  /kortex_lite/control/add_act.php

Abstract:

The SQL statement executed in 49 lines of code is composed of external input collages. Due to the lack of filtering or precompilation, attackers can achieve SQL injection by constructing statements through annotations.

Details:

In this case the data is passed to exec() in add_act.php at line49.

The interface can be found in "add acts".

 sqlmap.py -r sql_test2.txt

sqlmap.py -r sql_test.txt --current-db