The WEB control panel prior to 2019-04-30 for ClonOS allows SQL injection in clonos.php.
clonos project clonos