SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote malicious users to execute arbitrary SQL commands via the id parameter.
powie plink 2.07