BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php.