Sql injection

An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php Pid parameter...