An unauthenticated attacker can inject arbitrary SQL through the web application’s ‘urun’ GET parameter. The flaw supports boolean‑based blind, error‑based, time‑based blind, and stacked query attacks, potentially enabling the attacker to read, modify, or delete sensitive data stored in the backend database. Based on the description, it is inferred that these actions could expose customer information, disrupt transactions, and undermine business operations.

The vulnerability applies to Web‑Ofisi Ticaret V4, specifically the E‑Ticaret 4.0 web application. No specific version information is disclosed in the data.

The vulnerability has a CVSS score of 8.8, classifying it as high severity. Its EPSS score is below 1 %, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The attack vector is remote, as the attack can be performed by sending an unauthenticated HTTP GET request to the vulnerable endpoint. The vulnerability can be exploited without requiring additional privileges or user interaction, making it relatively easy for attackers skilled in SQL injection.