A critical SQL Injection vulnerability was identified in edu Business Solutions Print Shop Pro WebDesk version 18.34. The vulnerability, present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint, allows remote attackers to execute arbitrary SQL commands due to unsanitized user input being incorporated directly into SQL queries without proper parameterizatio [truncated]
CRITICALEdu Business SolutionsCVE published 2026-01-08
A critical vulnerability exists in edu Business Solutions Print Shop Pro WebDesk version 18.34. This issue, located in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint, allows a remote attacker to create financial discrepancies by purchasing items with a negative quantity. The vulnerability is due to reliance on client-side input validation controls. The vendor has fixed this issue in version 19.69.
