A flaw in the Online Store System CMS allows attackers without authentication to inject SQL code through the email parameter of the clientaccess endpoint. By sending crafted POST requests to index.php with the action=clientaccess parameter, an attacker can perform Boolean‑based or time‑based blind SQL injection, enabling extraction of sensitive database information. The vulnerability does not rely on user privileges and can be exploited from any external host capable of communicating with the web server.

The vulnerability affects the Online Store System CMS 1.0 developed by Wecodex. The exposed code is the index.php script handling clientaccess requests via the email field. No other product versions are specified as impacted.

The CVSS score of 8.8 reflects a high severity potential for information disclosure. The EPSS score is below 1%, suggesting that zero‑day exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only the ability to send a crafted HTTP POST request to the vulnerable endpoint over the network; no additional privileges or internal access are required.