Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.