Database disclosure and modification via concatenated query values

SQL injection in the Store component of Tynx wuersch allows remote authenticated users to read or modify database data through crafted values. Store.class.php concatenates caller-controlled identifiers and values into SQL strings instead of consistently binding them as PDO parameters. Exploitation requires low-privileged access from an adjacent network and a code path that passes attacker-controlled input to the affected Store methods.