The application, Ecommerce-project-with-php-and-mysqli-Fruits-Bazar version 1.0, contains a flaw that allows an attacker to inject arbitrary SQL statements into the /show_price_by_pdtId.php script. The vulnerability arises because user supplied parameters are concatenated directly into an SQL query without validation or sanitization, creating a classic SQL injection (CWE-89). An attacker could use this flaw to read sensitive product pricing information, modify or delete database records, or potentially extract all data from the underlying MySQL database, leading to confidentiality and integrity violations.

The affected product is the Fruits‑Bazar e‑commerce application shipped at version 1.0. No vendor or product details are publicly listed, but the vulnerable URL path /show_price_by_pdtId.php is known.

The CVSS score of 9.8 places the issue in the critical severity range, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is a remote web request to the vulnerable PHP script with crafted parameters, implying that any exposed instance of the application could be targeted without the need for local access.