Technical impact
An improper neutralization of special elements used in an SQL command allows a blind SQL injection vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website. This is a classic input validation flaw (CWE‑89) that enables an attacker to probe the backend database indirectly through returned error messages or timing differences, potentially revealing sensitive data such as customer information, order details, or authentication credentials.
Affected Systems
Vulnerable to Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website versions prior to 4.5.001. Systems operating those releases are susceptible to injection exploits via user input fields exposed by the web interface.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical severity, and although EPSS is not available, the high score and the nature of blind SQL injection imply a non‑negligible risk of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the lack of mitigation or patch information suggests it could be exploited from the public internet. Based on the description, the likely attack vector is through the web form inputs that accept unescaped SQL commands, such as product search or login fields.
