Description

There exists an SQL injection affecting the ['order'][0]['dir'], start and length parameters located in the file /module/accounts/ajax.php

Let's take a look at the following code: https://github.com/unilogies/bumsys/blob/9dc2de204116297a7e528c38bc3b1e89bf40f907/module/accounts/ajax.php#L1503

        group by company_id order by company_name ". safe_input($requestData['order'][0]['dir']) ."
        LIMIT ". safe_input($requestData['start']) .", ". safe_input($requestData['length']) ."

Even though the input variables are sanitized, there are no quotes needed to inject into the SQL query.

Fix

Sanitize ['order'][0]['dir'], start and length parameters

Impact

Authenticated users are able to disclose the contents of the database.