Sql injection

SQL injection vulnerability in search.php in Open Searchable Image Catalogue OSIC 0.7.0.1 and earlier allows remote attackers to inject arbitrary SQL commands via the 1 txtCustomField and 2 CustomFieldID array parameters...