Wasn't this reported a long time ago? http://www.securityfocus.com/bid/15141 Paros is prone to a remote authentication bypass vulnerability. This issue may result in the disclosure of sensitive information, and possible execution of commands on the victim machine. Paros version 3.2.5 is affected; earlier versions may also be vulnerable. Update: version 3.2.6 was released and addresses this issue from remote computers, as the database listens only on localhost by default. This still allows local users to connect, as the default username of "sa" with a blank password is still used.
