The Citrix Broadcast Server administrative login page is vulnerable to trivial SQL injections via the txtUID HTTP POST parameter. An attacker could leverage this flaw to obtain unauthorized access to the web interface or to extract data from the database via blind SQL injection.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/73385/DDIVRT-2008-16.txt
Source: https://packetstormsecurity.com/files/73385/Digital-Defense-VRT-Advisory-2008.16.html