Paroiciel 11.20 contains a flaw that permits attackers with authentication to inject SQL statements through the zProIdPro parameter in requests to zpro.php. The injected statements enable the attacker to retrieve sensitive database contents such as usernames, database names and server versions. The weakness aligns with CWE‑89, illustrating improper input handling that leads to arbitrary SQL execution and potential data compromise.

The vulnerability affects the Paroiciel application, version 11.20. Any deployment running this release is potentially susceptible; newer releases may address the issue, but the CVE references do not indicate a fix in later versions.

The CVSS score of 7.1 indicates a high impact when combined with the requirement of authenticated access. No EPSS information is available, but the presence of an exploit in Exploit‑DB suggests that attackers could leverage the flaw. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated against the application and craft a GET request containing malicious SQL payloads targeting the zProIdPro parameter.