SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')