CVE-2017-17618: Improper Neutralization of Special Elements used in an SQL Command

Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter...