:S@BUN has reported a vulnerability in Smoothflash, which can be exploited by malicious people to conduct SQL injection attacks.Input passed to the "cid" parameter in admin_view_image.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.Successful exploitation allows e.g. retrieving administrator usernames and password hashes.Solution:Filter malicious characters and character sequences in a web proxy.Provided and/or discovered by:S@BUNOriginal Advisory:http://milw0rm.com/exploits/5322

Original post by kapil