Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy (2) sortOrder (3) startReg (4) U (5) LastCheck and (6) R parameters.