CVE-2017-15381: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...