Remote Code Execution Vulnerability in gridx latest version

[mayoterry]

hi,
We found a remote code execution vulnerability in gridx latest version that could allow an attacker to remotely execute arbitrary code to attack an attack server.

code line in 265: The query parameter is directly brought into the eval function.

payload:
http://127.0.0.1/gridx-master/tests/support/stores/test_grid_filter.php?query=phpinfo();

This payload execution phpinfo();

fix:
In php, the eval function is dangerous. It is not recommended to use it. If you must use it, you need to limit the incoming data.

[jsonn]

This is a test case that shouldn't be deployed to a live system anyway.