CVE-2008-0738

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idcust parameter to a ajaxgetTiers.asp and b ajaxgetCust.asp in ajax/, and the 2 tableName parameter to c ajax/ajaxtableFields.asp. NOTE...