Smartshop 1 includes a time‑based blind SQL injection flaw (identified as CWE‑89) exposed through the 'searched' parameter in search.php. Attackers do not need authentication and can send crafted GET requests, such as those containing SLEEP functions, to cause delays and infer database contents. This allows extraction of sensitive data, including product and system information, effectively compromising confidentiality.

The vulnerability affects the Behance Smartshop 1 e‑commerce platform. No specific version range is provided, so all installations of Smartshop 1 are potentially impacted.

With a CVSS score of 8.8 the flaw qualifies as high severity. The EPSS score is unavailable, and it is not listed in the CISA KEV catalog, but the lack of authentication and the ability to harvest data through benign HTTP requests make exploitation likely for attackers with web access. The attack vector is a direct web request to the vulnerable endpoint, enabling attackers to extract information without further privileges.