Authenticated database disclosure via unsanitized delete identifier

SQL injection in PHPMyWind 5.6 allows remote authenticated users to read database contents through the administrator delete function. The /admin/admin_save.php action=del path places the attacker-controlled id parameter into a database query without proper neutralization, enabling error-based extraction through updatexml. Site-administrator access is required; the published proof of concept demonstrates disclosure of a super-administrator password hash.