EE 1.22 and 1.5RC4 SQL Injection Vulnerability

I've written about a SQL Injection vulnerability in EE 1.22 and 1.5RC4 on my website:

http://echeng.com/journal/2006/01/21/ee-15...-vulnerability/

If you're running Exhibit Engine, you should fix the problem.

Done, thanks for the heads up.

Done, thanks for the heads up.

Ditto. EEv2 comes out soon - it looks awesome.

You doing away with EE for good Eric?

~Matt Segal

EE (Exhibition Engine) has been unsupported for 3.5 or 2.5 years, depending on how you look at it. I hate unsupported software, and have abandoned EE for that reason. What's to say that EE v2 won't come out and then be unsupported for three more years? I don't want to rely on the community to find security holes and patch them...