Pre Printing Press 'pid' Parameter SQL Injection Vulnerability
28 Oct. 2012
Summary
Pre Printing Press is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Credit:
The information has been provided by Easy Laster
Vulnerable Systems:
* Preprojects Pre Printing Press 0 and prior
Pre Printing Press is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the page.php and product_desc.php scripts using the id and pid parameters, which could allow the attacker to view, add, modify or delete information in the back-end database.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2012-5334 : SQL injection vulnerability in product_desc.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the pid parameter.
