Code injection in PHPGroupware

It's possible to inject PHP code and to modify SQL query...