Freshmail for WordPress < 1.6 - shortcode.php SQL Injection

Description

There is a SQL Injection vulnerability available for collaborators (or higher privileged users) for webs with freshmail plugin installed. The SQL Injection is located in the attribute "id" of the inserted shortcode [FM_form id="N"]. The shortcode attribute "id" is not sanitized before inserting it in a SQL query.

A collaborator can insert shortcodes when he/she is editing a new post or
page and can preview the results (no administrator approval needed),
launching this SQL Injection.