SQL injection vulnerability in index.php in Easy CafeEngine 1.1 allows remote malicious users to execute arbitrary SQL commands via the itemid parameter.
cafeengine easycafeengine 1.1