There is a sql injection vulnerability via index.php?m=home&c=message&a=add

[Echox1]

use time-based bind injection to prove the vulnerability