Paroiciel SQL Injection Vulnerability in eGeqIdEquipe Parameter

A SQL injection vulnerability has been identified in Paroiciel version 11.20. This vulnerability allows authenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the eGeqIdEquipe parameter. Exploitation involves sending crafted GET requests to the egeq.php endpoint, which can lead to the extraction of sensitive database information, including version details and other data.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the egeq.php endpoint with the eGeqIdEquipe parameter. Inject a crafted SQL payload that exploits the application's SQL query handling. The server response should indicate successful exploitation, such as returning database information or application data that should not be accessible.