PhxEventManager 2.0 beta 5 search. php search_terms SQL injection and repair

Title: phxEventManager 2.0 beta 5 search. php search_terms SQL
Injection Vulnerability
Author: skysbsb
: Http://sourceforge.net/projects/phxeventmanager/
Test Platform: Apache/* nix
Powerful address: http://www.bkjia.com/path_to_pem/search. php?
POSTDATA:
Datasubmit = 1 & searchtype = events & s_event_names = on & s_event_descriptions = on & s_event_presenters = on & s_event_contacts = on & search_terms ='
Result:
MDB2 Error: syntax error, _ doQuery: [Error message: cocould not execute
Statement] [Last executed query: SELECT * FROM pem_entries as e, pem_dates
As d WHERE e. id = d. entry_id AND () AND e. entry_status! = 2 AND
D. date_status! = 2 AND (e. entry_visible_to_public = 1 AND
D. date_visible_to_public = 1) AND (e. entry_status! = 0 AND d. date_status! =
0) AND d. when_begin> = DATE_SUB (CURDATE (), INTERVAL 1 YEAR)] [Native code:
1064] [Native message: You have an error in your SQL syntax; check
Manual that corresponds to your MySQL server version for the right syntax
To use near ') AND e. entry_status! = 2 AND d. date_status! = 2 AND
(E. entry_visible_to_public 'at line 1]
 
Fix: Filter