Users can read subject from other message

Hello,

i found a bug when user A send a message to user B, it is for user C possible to display the subject from this message by changing the number from messages.php id= (example: messages.php?thread_id=111).
I also tried it on your site, the subject of the first message from your Support System with the ID1 is "Support Request | How to customize The Footer of This PSD?".

It would be very nice if you could tell me how I can fix this error, it would be nice if the user would receive an error message (You are doing something you don't have access to do.) or nothing is displayed.


Many Thanks,
Endober

I also found out that it is possible, when you enter behind the url a ' or %27 an SQL syntax error occurs, example link: https://www.webfulcreations.com/members/messages.php?thread_id=2590%27
I don't know my way around very well, but it is obviously a weak point that can be exploited for SQL injection. Error code example: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''10''' at line 1

Thanks for your support.

Here is the fixed version 

Files to update >> lib >> Classes >> messages.php   lib >> includes >> functions.php

thanks