CVE-2025-61548: Print Shop Pro WebDesk SQLi Vulnerability

CVE-2025-61548 Overview

CVE-2025-61548 is a SQL injection vulnerability in edu Business Solutions Print Shop Pro WebDesk version 18.34. The flaw exists in the hfInventoryDistFormID parameter of the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint. Unsanitized user input is concatenated directly into SQL queries without parameterization or escaping. Remote attackers can execute arbitrary SQL commands against the backend database without authentication. The vendor addressed the issue in version 19.69. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can read, modify, or delete database contents and potentially achieve further compromise of the hosting application server.

Affected Products

edu Business Solutions Print Shop Pro WebDesk 18.34
Earlier versions of Print Shop Pro WebDesk prior to 19.69
/PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint

Discovery Timeline

2026-01-08 - CVE-2025-61548 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-61548

Vulnerability Analysis

The vulnerability resides in the GetUnitPrice method exposed by CartV12.aspx in Print Shop Pro WebDesk. The endpoint accepts the hfInventoryDistFormID parameter from the client and incorporates the value directly into a SQL query string. Because the application does not use parameterized queries or input sanitization, an attacker can inject SQL syntax that alters query logic.

Exploitation requires no authentication, no user interaction, and can be performed remotely over the network. Successful injection grants full read and write access to data accessible by the application's database user account.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The application builds SQL statements through string concatenation with untrusted input from the hfInventoryDistFormID HTTP parameter. The absence of prepared statements, stored procedure parameter binding, or input validation allows attacker-controlled SQL fragments to be parsed and executed by the database engine.

Attack Vector

An attacker sends a crafted HTTP POST request to /PSP/appNET/Store/CartV12.aspx/GetUnitPrice with a malicious payload in the hfInventoryDistFormID field. Typical payloads include UNION-based queries to extract data, boolean-based blind injection to enumerate schemas, or time-based blind injection using WAITFOR DELAY on Microsoft SQL Server.

Depending on database privileges, the attacker may pivot to executing operating system commands using extended procedures such as xp_cmdshell. Refer to the GitHub CVE-2025-61548 Disclosure for technical details.

Detection Methods for CVE-2025-61548

Indicators of Compromise

HTTP POST requests to /PSP/appNET/Store/CartV12.aspx/GetUnitPrice containing SQL keywords such as UNION, SELECT, WAITFOR, or -- in the hfInventoryDistFormID parameter
Anomalous database errors logged by the Print Shop Pro WebDesk application around CartV12 transactions
Unexpected outbound connections from the database server following requests to the affected endpoint
Creation of new database users or unusual access to system tables such as INFORMATION_SCHEMA or sysobjects

Detection Strategies

Inspect IIS or reverse proxy logs for POST requests to the GetUnitPrice endpoint containing encoded SQL metacharacters
Deploy Web Application Firewall (WAF) signatures targeting SQL injection patterns on parameters ending in FormID
Enable SQL Server auditing to flag dynamic queries containing concatenated user input from the application service account

Monitoring Recommendations

Forward IIS access logs and SQL Server audit events to a centralized analytics platform for correlation
Alert on response time anomalies on the GetUnitPrice endpoint, which may indicate time-based blind injection
Monitor for unexpected use of database administrative procedures from the WebDesk application context

How to Mitigate CVE-2025-61548

Immediate Actions Required

Upgrade Print Shop Pro WebDesk to version 19.69 or later, which contains the official fix
Restrict network access to the /PSP/appNET/Store/CartV12.aspx endpoint to trusted networks until patching is complete
Review database logs for prior indicators of injection attempts against the affected parameter
Rotate credentials and audit data accessed by the WebDesk database service account if compromise is suspected

Patch Information

edu Business Solutions has released Print Shop Pro WebDesk version 19.69, which remediates the SQL injection in the hfInventoryDistFormID parameter. Customers should obtain the update directly from the vendor and follow the standard upgrade procedure. See the GitHub CVE-2025-61548 Disclosure for additional technical context.

Workarounds

Deploy WAF rules to block requests to /PSP/appNET/Store/CartV12.aspx/GetUnitPrice containing SQL metacharacters in hfInventoryDistFormID
Apply database least privilege by ensuring the WebDesk service account cannot execute xp_cmdshell or modify system catalogs
Place the application behind authenticated access controls such as VPN or SSO until the patch is applied

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in the vulnerable parameter
SecRule ARGS:hfInventoryDistFormID "@rx (?i)(union(\s+all)?\s+select|waitfor\s+delay|';|--|/\*)" \
    "id:1006154,phase:2,deny,status:403,log,msg:'CVE-2025-61548 SQLi attempt on CartV12 GetUnitPrice'"