Easy Laster has reported a vulnerability in smartplugs, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "domain" parameter in showplugs.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

Solution
Reportedly, the vendor has released a hotfix, which fixes this vulnerability. Contact the vendor for more details.

Provided and/or discovered by
Easy Laster

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://4004securityproject.wordpress.com/2010/03/03/smartplugs-1-3-sql-injection-showplugs-php/

Deep Links
Links available to Secunia VIM customers