Smartshop 1 contains a SQL injection vulnerability that allows attackers to inject malicious SQL through the id parameter in product.php. Unauthenticated users can send GET requests containing union-based payloads to execute arbitrary queries, extracting sensitive information such as usernames and database names. The weakness stems from improper handling of user input, classified as CWE‑89, and results in a breach of confidentiality.

The affected product is Behance Smartshop. No specific version information is listed, so all current deployments of this application are potentially vulnerable until a patch or fix is applied.

The CVSS score of 8.8 indicates a high severity risk level. Exploitation is straightforward via a web request to product.php and requires no authentication. The EPSS score is not available, but the absence of mitigation and the nature of the vulnerability suggest a high likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV catalog.