Multiple authenticated SQL injection via extraParam

An improper neutralization of special elements used in an SQL command 'SQL injection' CWE-89 in FortiVoice may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests...