ImpressCMS versions 1.3.9 and below suffer from a remote SQL injection vulnerability.