SQLi in LASCO CME Query

How it was found

Summary: There is sqli in the form █████████ on the "CME DateTime" parameter.

I'm also fairly sure ████████ has similar SQLis but its somehow protected by a WAF.

Description:

Impact

The impact is probably quite low but I have not checked to see what other data is accessible via the sqli (loadfile, other databases etc. )

Step-by-step Reproduction Instructions

1. Go to ████████. Enter ' and 1 or 1 GROUP BY CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2)) HAVING MIN(0) OR 1 -- - in CME DateTime field
2. It will print out the MySQL server version