Get the IDs from $_REQUEST and check if they are numeric.

appbrowse.php

@@ -22,9 +22,17 @@ function admin_menu()
     $m->done();
 }
 
+$catId = $_REQUEST['catId'];
+
 if(!$catId)
     $catId = 0; // ROOT
 
+if( !is_numeric($catId) )
+{
+	errorpage("Something went wrong with the category ID");
+	exit;
+}
+
 // list sub categories
 $cat = new Category($catId);
 $catFullPath = make_cat_path($cat->getCategoryPath());