Jizhicms v2.5.4 contains a critical SQL injection flaw in the product editing module. Attackers can inject arbitrary SQL commands, enabling them to read, modify, or delete data stored in the database. The vulnerability could lead to unauthorized disclosure of sensitive information and compromise the integrity of the system’s data. Based on the description, the flaw is likely exploitable through the product editing interface, which may be accessed by authenticated users with permission to edit products.

Only Jizhicms version 2.5.4 is known to be affected, as indicated by the CPE string cpe:2.3:a:jizhicms:jizhicms:2.5.4. Administrators should verify whether their installations run this exact release, as earlier or later versions may not contain the flaw.

The CVSS score of 9.8 marks this issue as critical. Although the EPSS score is less than 1%, suggesting that exploitation is not yet widespread, the high severity combined with the potential for data exposure necessitates prompt action. The vulnerability is not listed in the CISA KEV catalog, but the absence does not reduce its risk. Attacks would likely target the product editing module, possibly requiring authorization, and could result in data theft or tampering.