Smartshop 1 contains an input-bypass vulnerability that allows an unauthenticated attacker to execute arbitrary SQL statements by injecting payloads into the id parameter of category.php. The flaw is a classic UNION-based parameter injection (CWE-89) that can read sensitive data, such as usernames, passwords, and other confidential database content. It grants the attacker the ability to obtain and exfiltrate database information without requiring any prior authentication.

The vulnerability affects the Smartshop 1 e‑commerce platform supplied by Behance. No specific application version or patch level is listed; any deployment that includes the unpatched category.php endpoint is potentially exploitable.

The CVSS score of 8.8 indicates a high‑severity flaw with a wide impact scope. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint via standard HTTP GET requests to category.php, making exploitation straightforward over the public web. Because no authentication is required, the attacker can immediately query the database to extract sensitive information.