item.php is vulnerable to sql injection

[GoogleCodeExporter]

What steps will reproduce the problem?
1. /item.php?id=[ insert SQLi without the brackets]
2.
3.

What is the expected output? What do you see instead?
admin password is displayed, as well as other information depending
on the sql injection used

What version of the product are you using? On what operating system?
Version 1.1.0A

Please provide any additional information below.
Just follow in the recently published exploit.
http://www.exploit-db.com/exploits/11496

Original issue reported on code.google.com by lonefer...@gmail.com on 18 Feb 2010 at 4:49

[GoogleCodeExporter]

Security hole repaired in the subversion repository.

Original comment by santiago...@gmail.com on 7 Mar 2010 at 8:45

• Changed state: Fixed