Bug Report: SQL injection vulnerability

[cuhanboy]

Hi, @cskaza I found a high-risk time-based blind SQL injection vulnerability in the member function module.
（http://website/member/edit）

the vulnerable code is on cszcms/models/csz_model.php

The vulnerability parameter is pm_sendmail.This parameter is passed to the database query without any filtering, resulting in a vulnerability.

All the data in the database can be obtained by using sqlmap.

[cskaza]

Resolved done on next version.