Vulnerability Report: Path Traversal and SQL Injection in `com_gridbox` (compressImage task)

**Subject:** Vulnerability Report: Path Traversal and SQL Injection in `com_gridbox` (compressImage task)

**Vulnerability Description:**
The component `com_gridbox` is vulnerable to **Path Traversal** and **SQL Injection** via the `image` and `task` parameters in the `gridbox.compressImage` function. Attackers can manipulate the `image` path to create or access directories with illegal names (e.g., `.\`, `...`) and execute blind SQL injection attacks.

**Technical Details:**

* **Affected Task:** `gridbox.compressImage`
* **Vulnerable Parameters:** `image`, `task`
* **Attack Vector:** Remote attackers can send crafted GET/POST requests containing directory traversal sequences (`../`) or SQL commands.

**Payload Examples from Logs:**

1. `task=gridbox.compressImage&image=../../../../images/compress/.\/` (Results in illegal folder creation)
2. `task=gridbox.compressImagetb"||sleep(27*1000)` (SQL Injection attempt)
3. `image=-1" OR 5*5=25 --` (Logical bypass attempt)

**Impact:**

* Unauthorized file/folder creation on the server.
* Potential remote code execution (RCE) if a shell is uploaded to the created directory.
* Database information disclosure via SQL injection.

**Recommended Fix:**

1. Sanitize the `image` parameter to disallow directory traversal sequences (`..`, `\`, `/`).
2. Implement strict input validation and use prepared statements for all database queries.
3. Restrict folder creation permissions within the `compress` directory.