Description
A remote SQL injection vulnerability exists in Softbiz Classifieds PLUS through the id parameter. The parameter is directly used in SQL queries without proper sanitization.
Impact
Attackers can inject arbitrary SQL commands to extract all data from the database, including classified listings, user accounts, personal information, and administrative credentials.
Solution
Apply parameterized queries to the id parameter. Contact Softbiz for a security patch.