Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu…

CVE-2018-25428 affects Paroiciel version 11.20, containing an SQL injection vulnerability in the tRecIdListe parameter. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries through GET requests to the trec.php endpoint. Attackers can craft SQL payloads to extract sensitive database information including table and column names. This represents a critical security flaw that enables unauthorized database access without authentication requirements. The vulnerability has been documented with exploit code available on Exploit-DB.