CVE-2025-61548

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-61548
SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 Exploit Third Party Advisory
https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:edubusinesssolutions:print_shop_pro_webdesk:18.34:*:*:*:*:*:*:*
History

10 Feb 2026, 18:16

Type Values Removed Values Added
Summary (en) SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34. Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands (en) SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands

22 Jan 2026, 15:29

Type Values Removed Values Added
CPE cpe:2.3:a:edubusinesssolutions:print_shop_pro_webdesk:18.34:*:*:*:*:*:*:*
References () https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 - () https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 - Exploit, Third Party Advisory
First Time Edubusinesssolutions print Shop Pro Webdesk
Edubusinesssolutions

08 Jan 2026, 20:15

Type Values Removed Values Added
CWE CWE-89
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 - () https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61548 -

08 Jan 2026, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-08 17:15

Updated : 2026-02-10 18:16

NVD link : CVE-2025-61548

Mitre link : CVE-2025-61548

CVE.ORG link : CVE-2025-61548

JSON object : View

Products Affected

edubusinesssolutions

  • print_shop_pro_webdesk
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')