[Security] Stored SQL Injection via Export Template — 5 sinks (CWE-89)

[TuanHung1149]

Security Vulnerability Report

Discovered by: SuyZ (UIT — University of Information Technology, Ho Chi Minh City)

I've discovered 5 stored SQL injection sinks in the Export Template functionality:

1. condition.Column — raw fmt.Sprintf in sys_export_template.go:226
2. condition.Operator — same line
3. template.SQL — db.Raw()
4. JoinTemplate — db.Joins()
5. tableName — db.Table()

CreateSysExportTemplate only validates Name, NOT these fields. Default credentials admin/123456.

HIGH (CVSS 8.6) | 6/6 Go test PoC PASS | All 5 DB backends affected

Per SECURITY.md, I will also send the full report to qimiaojiangjizhao@gmail.com.