PHP Melody releases before January 26th 2017 are vulnerable to SQL injection and should be patched immediately.

In case you cannot use the official package to update your PHP Melody website(s), simply apply the following changes to patch your site against intrusion. Updating is still required but can be safely postponed to a later date.

Open file: /comment.php

Find:

$user_id = $_POST['user_id'];

Replace with:

$user_id = 0;

If you have Mobile Melody installed:

Open file: /mobile/comment.php

Find:

$user_id = $_POST['user_id'];

Replace with:

$user_id = 0;

For PHP Melody versions v2.5 and later, phpmailer can be easily updated as well.

Download phpmailer.zip and replace your existing /include/phpmailer/ folder with the one form the zip archive.

These two code patches should provide adequate security to your PHP Melody website(s). We do however recommend updating to the latest PHP Melody version to fix any pending bugs.

To download the complete update packages visit your customer account with us. To patch this critical vulnerability, you need to run at least PHP Melody v2.7.1.