Fixed Security issues regarding SQL Injection under special circumstances.
This was only possible for logged in users.
This was reported @ http://www.exploit-db.com/exploits/24269/