Sql injection

Multiple SQL injection vulnerabilities in PHPhotoalbum 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 album parameter to thumbnails.php and the 2 pid parameter to displayimage.php...