Sql injection

In the module "Creative Popup" creativepopup up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cpdownloadpopup...