Rivettracker 1.03 SQL Injection

Exploit Title: Multiple SQL injections in rivettracker =5.3.4 and backports we still have arbitary SQL queries but no config.php. config.php contains passwords...