Secunia

Aliaksandr Hartsuyeu has discovered a vulnerability in SZUserMgnt, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "username" parameter in "login.verify.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerability has been confirmed in version 1.4. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
Aliaksandr Hartsuyeu

Changelog
Further details available in Customer Area

Original Advisory
http://evuln.com/vulns/53/summary.html

Deep Links
Links available in Customer Area