Severity: Critical Effect: Compromise of FInancial Data, deletion of audit trails, alteration of system settings, disclosure of confidential information possible in some setups. Affected products: LedgerSMB 1.0.0-1.2.7 , SQL-Ledger 2.x (all versions). 1: SQL injection issue in invoice quantity field 2: SQL injection issue in sort field. Solution to issue on LedgerSMB: Upgrade to 1.2.8. Solution to issue on SQL-Ledger: Unfortunately the maintainer of SQL-Ledger has declined to fix any of the SQL injection issues we have sent his way. Even correcting these, there are many SQL injection issues in that application. Our official recommendation for SQL-Ledger users is to restrict access to database relations to the least privelege necessary. While this does not entirely solve the issues, it does limit the damage considerably. Best Wishes, Chris Travers