Bypas

**Name of the Vulnerable Software and Affected Versions** websihirbazi version 5.1.1 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two parameters: (1) the `id` parameter to "default.asp" in a news page action, and (2) the `pageid` parameter to "default.asp". **Recommendations** For websihirbazi version 5.1.1, consider restricting access to the `id` and `pageid` parameters in the "default.asp" page until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this issue.