Multiple scripts with multiple parameters are affected from this vulnerability. Example #1: index.php?section=redir&affid=0&kid=0&zid=[SQL Injection]. Example #2: Visit the 'register' page index.php?section=user&action=register and enter your SQLi string into the email field. Fill out the other fields with some normal stuff (like test) and view your result. Visit the 'register' page index.php?section=user&action=register and enter your CSRF string into the email field. Fill out the other fields with some normal stuff (like test) and view your result. Visit index.php?section=doc&action= and fill out the action parameter. Example: index.php?section=doc&action=test. Visit index.php?section=doc&action=test and play around with both the section and action parameters. You will notice that a local file inclusion is not possible, but you will get an interesting error message.