не знаю как в 1.0.5 но в 1.0.6 параметр id уязвимо, хотя скуля без вывода

modx/manager/actions/mutate_user.dynamic.php

[PHP]
PHP:
[COLOR="#000000"]if ($_GET['a'] =='12') {// only do this bit if the user is being e dited

$sql="SELECT * FROM$dbase.`".$table_prefix."member_groups` where member=".$_GET['id'] ."";

$rs=mysql_query($sql);

$limit=mysql_num_rows($rs);

for ($i=0;$i[COLOR="#007700"]