US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
rowindex us zip codes database script 1.0