CVE-2008-0546

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idProduct and 2 options parameters to a ajax/ajaxoptInventory.asp, or the 2 recid parameter to b ajax/ajaxgetBrands.asp...