CVE-2017-17626: Improper Neutralization of Special Elements used in an SQL Command

Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter...