Bitrix mcart.xls module versions 6.5.2 and below suffer from a remote SQL injection vulnerability. Continue reading...