phpGiftReq 1.4.0 suffers from multiple SQL injection flaws that allow for manipulation of the database.