CVE-2017-6492: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection was discovered in admprogram/modules/dates/datesfunction.php in Admidio 3.2.5. The POST parameter datcatid is concatenated into a SQL query without any input validation/sanitization...