PhpIX 2012 Professional SQL Injection Vulnerability in Product Detail Page

A SQL injection vulnerability has been identified in PhpIX 2012 Professional, specifically in the 'id' parameter of the product_detail.php file. This vulnerability allows remote attackers to manipulate database queries by injecting malicious SQL code, potentially leading to unauthorized access or modification of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the product_detail.php page with an injected SQL payload in the 'id' parameter. The injection can be crafted to manipulate the SQL query and exploit the application's database handling.