The vulnerability is a blind SQL injection that exists in CoreShop before version 4.1.8. An authenticated administrator can use boolean-based or time-based techniques to extract data from the read‑only database account. Because the database account is non‑DBA, an attacker cannot modify data or disrupt services; the main risk is disclosure of confidential information.

The affected product is CoreShop from the coreshop vendor. All releases prior to 4.1.8 are vulnerable, and the patch addressing the flaw was introduced in that version. No other product versions are indicated as affected.

The CVSS score of 4.9 places the vulnerability in the medium severity range, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack chain requires authenticated administrator credentials, enabling an insider or compromised account to repeatedly submit crafted queries to read data via blind techniques. No data modification or service disruption is possible from this vector.