Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow an unauthenticated attacker to manipulate database queries through the unvalidated 'id' parameter in index.php or the 'Email' parameter in loginaction.php, enabling extraction of sensitive database content via time‑based blind SQL payloads. The impact of successful exploitation is the potential disclosure of confidential data stored in the application database, possibly compromising customer personal information and transactional data.

The affected product is Netartmedia PHP Mall version 4.1. No other versions or vendor products are listed as vulnerable.

The vulnerability has a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of widespread exploitation in the near term. It is not listed in the CISA KEV catalog. Exploitation requires only unauthenticated web access and can be performed directly by crafting HTTP requests to the vulnerable parameters, making the attack vector straightforward and potentially automated.