Keopssgroup0Day

The software contains a SQL injection issue in the search functionality. Attackers can manipulate database queries through unvalidated user input. Specifically, malicious SQL code can be injected through the `search` parameter to potentially extract, modify, or access sensitive database information.

The software contains a time-based blind SQL injection issue in the admin interface. Attackers can manipulate database queries through the `id` parameter. Exploitation involves crafting malicious payloads that cause time delays, allowing extraction of sensitive database information using conditional sleep techniques.