Multiple SQL injection vulnerabilities in akocomment.php in AkoComment 2.0 module for Mambo with magic_quotes_gpc disabled allow remote attackers to execute arbitrary SQL commands via the (1) acname or (2) contentid parameter.