The issue concerns a modular suite of web apps built with the sysadmin in mind. In the affected versions, the `$ REQUEST` global array was unsafely called inside an `extract()` function in `admin-logs.php`. Although the PHP file `fm-init.php` prevents arbitrary manipulation of `$ SESSION` via the GET/POST parameters, it does not prevent manipulation of other sensitive variables such as `$search sql`. An authenticated user with privileges to view site logs can manipulate the `$search sql` variable by appending a GET parameter `search sql` in the URL. This renders the checks and SQL injection prevention attempts unusable.