The vulnerability is an unauthenticated SQL injection in the 'urun' GET parameter of Web‑Ofisi E‑Ticaret 4.0. Attackers can inject malicious SQL, allowing boolean‑based blind, error‑based, time‑based blind, and stacked query attacks against the backend database. This can enable unauthorized data retrieval, modification, or deletion, potentially exposing sensitive information or compromising the integrity of the shop’s database.

The affected product is Web‑Ofisi E‑Ticaret V4, a web‑based e‑commerce platform. No specific version range is listed beyond V4, so all instances of that edition are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity. The exploit probability metric is missing, but the lack of a KEV listing suggests no publicly known exploitation yet. The flaw is reachable through the public web interface without authentication, implying a high likelihood of exploitation. Attackers can leverage this to extract sensitive data or alter the database, leading to significant information disclosure or integrity compromise.