CVE-2025-61548: Print Shop Pro WebDesk SQLi Vulnerability

CVE-2025-61548 Overview

CVE-2025-61548 is a SQL Injection vulnerability affecting edu Business Solutions Print Shop Pro WebDesk version 18.34. The vulnerability exists in the hfInventoryDistFormID parameter within the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint. Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping, allowing remote attackers to execute arbitrary SQL commands against the backend database.

Critical Impact

This vulnerability enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, data manipulation, and in some cases, remote code execution on the underlying server.

Affected Products

• edu Business Solutions Print Shop Pro WebDesk version 18.34

Discovery Timeline

• 2026-01-08 - CVE-2025-61548 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-61548

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) occurs when the application fails to properly sanitize user-supplied input before incorporating it into SQL queries. The vulnerable endpoint GetUnitPrice accepts the hfInventoryDistFormID parameter and directly concatenates its value into database queries without applying parameterized queries or adequate input validation.

The attack can be initiated remotely over the network without requiring any authentication or user interaction. An attacker can craft malicious SQL statements within the hfInventoryDistFormID parameter to manipulate query logic, extract sensitive data from the database, modify or delete records, or potentially gain further access to the underlying system depending on database permissions and configuration.

Root Cause

The root cause of this vulnerability is the direct inclusion of user-controlled input into SQL query strings without proper sanitization, escaping, or the use of parameterized queries (prepared statements). The application trusts the hfInventoryDistFormID parameter value and constructs SQL queries by string concatenation, allowing special SQL characters and commands to be interpreted as part of the query structure rather than as literal data values.

Attack Vector

The attack vector is network-based, targeting the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint. An unauthenticated remote attacker can send crafted HTTP requests containing malicious SQL payloads in the hfInventoryDistFormID parameter. The malicious input could include SQL commands such as UNION SELECT statements to extract data from other tables, boolean-based or time-based blind injection techniques to enumerate database contents, or stacked queries to execute additional SQL commands including data modification or administrative operations.

For technical details and proof-of-concept information, see the vulnerability disclosure on GitHub.

Detection Methods for CVE-2025-61548

Indicators of Compromise

• Unusual or malformed requests to the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint containing SQL metacharacters such as single quotes, semicolons, or SQL keywords
• Database error messages appearing in web server logs or application responses indicating SQL syntax errors
• Unexpected database queries or query patterns in database audit logs, particularly involving UNION, SELECT, or administrative commands
• Evidence of data exfiltration or unauthorized database access in security monitoring systems

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the hfInventoryDistFormID parameter
• Enable detailed logging on the web server for requests to the /PSP/appNET/Store/ path and analyze for injection patterns
• Configure database activity monitoring to alert on anomalous query patterns or unauthorized data access
• Deploy SentinelOne Singularity Platform to detect post-exploitation activity and lateral movement attempts following successful SQL injection

Monitoring Recommendations

• Monitor web application logs for requests containing SQL injection payloads such as 'OR, UNION SELECT, --, or encoded variants
• Enable database query logging and audit trails to identify unauthorized SQL command execution
• Set up alerts for unusual database connection patterns or bulk data retrieval operations

How to Mitigate CVE-2025-61548

Immediate Actions Required

• Restrict network access to the Print Shop Pro WebDesk application to trusted IP addresses or networks where possible
• Implement WAF rules specifically targeting SQL injection attempts on the affected endpoint
• Review database permissions and ensure the application uses a least-privilege database account
• Monitor for exploitation attempts while awaiting vendor patch

Patch Information

At the time of publication, no vendor patch information is available. Organizations should monitor edu Business Solutions for security updates addressing this vulnerability. The vulnerability disclosure on GitHub may contain additional remediation guidance.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts on the hfInventoryDistFormID parameter
• Implement network-level access controls to limit exposure of the Print Shop Pro WebDesk application to only authorized users and networks
• Consider taking the affected endpoint offline if it is not business-critical until a patch is available
• Enable enhanced logging and monitoring to detect any exploitation attempts

# Example WAF rule concept for blocking SQL injection on the affected parameter
# Note: Actual implementation depends on your WAF solution
# Block requests to GetUnitPrice containing SQL injection patterns
# SecRule ARGS:hfInventoryDistFormID "@detectSQLi" "id:1001,deny,status:403,log,msg:'SQL Injection Attempt Blocked'"