[Security] SQL Injection via _goadmin_join_ URL parameter key (CWE-89)

Security Vulnerability Report

Discovered by: SuyZ (UIT — University of Information Technology, Ho Chi Minh City)

I've discovered a SQL injection vulnerability via URL parameter key splitting. parameter.go:410 splits URL param keys by _goadmin_join_, and keys[0] is concatenated raw into WHERE clause. Both getData() and getDataFromDatabase() are affected.

CWE-89 | 9/9 Go test PoC PASS | UNION+SLEEP+file_read vectors proven

Per SECURITY.md, I will also send the full report to [email protected] with complete PoC and suggested fix.