Sql injection

SQL injection vulnerability in members.php in Arab Portal 2.2, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action...