SQL injection vulnerability in index.php in Airvae Commerce 3.0 allows remote malicious users to execute arbitrary SQL commands via the pid parameter.
airvae commerce 3.0