The vulnerability is an SQL injection flaw in PilusCart 1.4.1 that allows an unauthenticated attacker to manipulate database queries through the 'send' POST parameter. By sending crafted RLIKE-based boolean payloads to the comment submission endpoint, an attacker can extract sensitive database information. This flaw is classified as CWE-89 and leads to confidentiality compromise by exposing protected data.

Only the PilusCart 1.4.1 installation is affected. The product is provided by PilusCart, and version 1.4.1 lacks the necessary input validation or prepared statements for the 'send' parameter. Older versions prior to 1.4.1 are not impacted, and no other product versions were identified as vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability. Exploitation requires a simple unauthenticated POST request to the comment endpoint, making the attack vector likely to be web-based. While EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the high CVSS score and lack of defenses make it a significant risk for exposed installations. Attackers can leverage the flaw to gain unauthorized access to database contents without authentication.