ImpressCMS: SQL Injection through /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 281. $total = $userhandler-getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" :...