SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an malicious user to run arbitrary SQL commands via the DeliveryorderautoupdateOrdersModuleFrontController::initContent function.