RichardAnderson/AIOBB — Issue #1: SQL Injection possible when inserting a setting
Author: RichardAnderson
Created: 2011-11-08 11:48:57+00:00
State: open

It's possible to inject other SQL queries into the SQL statement executed when a new setting is inserted. The values for "Key" and "value" need to be cleaned before entered into the SQL statement.

includes/setting.php