Alcassoft's SOPHIA CMS is vulnerable to SQL injection. An attacker can inject malicious SQL queries into the vulnerable parameter 'pageid' in the 'dsp_page.cfm' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation of this vulnerability can result in the compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.