Technical impact
Paroiciel version 11.20 contains a CWE‑89 SQL injection flaw that allows authenticated users to inject arbitrary SQL statements into the eGeqIdEquipe parameter via GET requests to egeq.php. The vulnerability can be exploited to read or modify sensitive data stored in the application database, potentially exposing user credentials, business data, and system configuration.
Affected Systems
The flaw applies to installations of Paroiciel product 11.20; the vendor Paroiciel is the affected supplier. No additional version information is provided beyond 11.20, so all instances of this version are potentially vulnerable.
Risk and Exploitability
The CVSS score of 7.1 indicates a high impact with moderate to high exploitability. The EPSS score is not available, and the vulnerability is not listed in KEV, but the attack requires valid authentication and direct URL manipulation. Because only authenticated users can trigger the injection, privileged accounts are the primary threat vector. The risk is considered significant, especially in environments where the database contains sensitive information.
