WHMCS Group Pay Plugin 1.5 (grouppay.php, hash param) - SQL Injection

We have found a SQL injection inside the group pay plugin for WHCMS. A lot of game hosting companies are using this plugin. SQL Injection is in the function gpLoadUserFromHash. Exploits ============ - SQL Injection grouppay.php?hash=%hash%' and '1'='1 ============ Code SQL Injection ============...