CVE-2008-0738

CandyPress (CP) versions 4.1.1.26 and earlier 4.1.x are affected by multiple SQL injection vulnerabilities. Attack vectors involve user-supplied parameters: (1) idcust passed to ajax_getTiers.asp and ajax_getCust.asp in the ajax/ directory, and (2) tableName passed to ajax/ajax_tableFields.asp. T...