SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')