Pre Printing Press 'pid 'parameter SQL Injection Vulnerability

Release date: 2012-03-19
Updated on:

Affected Systems:
Preprojects Pre Printing Press
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52551
Cve id: CVE-2012-5334

Pre Printing Press is a complete website script for Printing machines, including all online Printing business features.

The product_desc.php of Pre Printing Press has the SQL injection vulnerability. Remote attackers can use the pid parameter to execute arbitrary SQL commands.

<* Source: r45c4l
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Preprojects
-----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.preprojects.com/