WS-2023-0133

In unilogies/bumsys before 2.2.0 there exists an SQL injection affecting the edition parameter located in the file core/ajax/ajaxdata.php...

SQL Injection in 'core/ajax/ajax_data.php'

Description There exists an SQL injection affecting the edition parameter located in the file core/ajax/ajaxdata.php php $productEditionFilter = isset$GET"edition" and !empty$GET"edition" ? " productedition = '$GET"edition"' " : " producttype != 'Child' "; We see that $GET"edition" is appended...