CVE-2011-0644: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in include/admin/modelfield.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flashupload.php...