Blocked accounts abused in Evolution CMS SQL injection attacks

On February 8, Synactiv revealed two security flaws in the CMS and how a “blocked account” can be exploited to perform an “unauthenticated SQLi in Evolution CMS using the X-Forwarded-For header”.