CVE-2019-25746

Name of the Vulnerable Software and Affected Versions Sliced Invoices version 3.8.2

Description An authenticated SQL injection allows attackers to manipulate database queries by injecting SQL code. This is achieved by sending requests to the 'admin.php' endpoint using the action=duplicate quote invoice parameter and providing malicious values in the post variable. Successful exploitation can lead to the extraction of sensitive database information or unauthorized data modification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.