Description
A remote SQL injection vulnerability exists in Softbiz Auctions Script through product_desc.php. The parameter is not properly sanitized before database queries.
Impact
Attackers can extract auction data, bidder information, financial transaction details, and administrative credentials from the database.
Solution
Apply parameterized queries to product_desc.php. Contact Softbiz for a security patch.