CVE-2018-14418

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI...