Wavelog 1.8.5 allows Gridmapmodel.php getband_confirmed SQL injection via band, sat, propagation, or mode.