A critical SQL injection vulnerability in PhpIX 2012 Professional allows remote attackers to manipulate database queries, potentially leading to unauthorized data extraction.

The application fails to properly sanitize user-supplied input within the id parameter of the product_detail.php script. This flaw allows an attacker with low privileges to inject malicious SQL commands into the backend database.

The ability to perform SQL injection poses a severe risk to the confidentiality and integrity of the application database. An attacker could potentially extract sensitive customer information, modify database records, or bypass authentication mechanisms. With a CVSS score of 7.1, this vulnerability is considered High, as it provides a direct path for attackers to compromise the underlying data layer.

Immediate Action: Since no official vendor patch is identified, administrators should restrict access to the affected script or implement input validation to sanitize the id parameter. If the software is no longer supported, migration to a modern, actively maintained alternative is strongly advised.

Proactive Monitoring: Security teams should monitor database logs for abnormal query structures, such as unexpected use of UNION or SLEEP commands, which are common indicators of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter in URI requests.

Public Exploit Available: Yes, a published proof of concept exists via the Exploit Database (EDB-ID 48138).

The presence of a publicly available exploit for this SQL injection vulnerability significantly increases the risk of successful compromise. Organizations currently running PhpIX 2012 Professional must prioritize the implementation of compensating controls, such as WAF rules, to sanitize traffic targeting the vulnerable parameter. Given the lack of a vendor-provided patch, decommissioning or isolating the application is the most effective way to eliminate this risk.