The issue concerns SQL injection in the administration panel, specifically in admin/tags.php. It can be exploited via the `tags` array parameter in an "admin.php?page=tags" request. The attacker must have administrator privileges to exploit this issue.