CVE-2017-7886: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...