HTB23092: Serendipity SQL injection

Serendipity version 1.6.1 and probably prior suffer from SQL injection vulnerability:
SQL Injection: Input passed via the "url" GET parameter to "comment.php" script is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Vulnerability ID: HTB23092
Vendor Notification / Patch / Public Disclosure Dates: 16 May / 16 May / 6 June 2012
Vulnerabilities Type: SQL injection
Risk level: High
Solution Status: Fixed by Vendor, upgrade to Serendipity 1.6.2.