CVE-2010-1327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the marca parameter to precios.php3 or 2 the where parameter in a deliverycourier action to control/abmlist.php3...