Netartmedia PHP Mall 4.1 contains multiple SQL injection flaws that enable any unauthenticated attacker to embed malicious SQL code into inbound parameters. By crafting crafted requests, an attacker can alter the intended database queries and retrieve sensitive data such as user credentials and system configuration. The vulnerability compromises the confidentiality of stored information and may allow further manipulation of database contents, potentially leading to unauthorized access or data tampering.

The affected product is Netartmedia PHP Mall version 4.1. No other versions or variations are specified, and the vendor explicitly identifies this single release as vulnerable.

The vulnerability scores a CVSS score of 8.8, indicating high severity and a significant potential impact on data integrity and confidentiality. The EPSS score is reported as under 1%, suggesting a low current exploit probability, and the flaw is not listed in the CISA KEV catalogue. The likely attack vector is an unauthenticated HTTP request to the web application, where the attacker can supply malicious payloads through user input fields before authentication is required.