Yanxiao

**Name of the Vulnerable Software and Affected Versions** QueryMine sms versions up to 7ab5a9ea196209611134525ffc18de25c57d9593 **Description** Remote SQL injection is possible via the GET Request Parameter Handler in the 'admin/editcourse.php' file. The issue occurs when the `ID` argument is manipulated, allowing an attacker to execute arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.