EverShop concatenates url_key values—derived from category URL keys—directly into SQL statements during category update and deletion event handling. This design flaw allows a second‑order SQL injection that can compromise data confidentiality and integrity by executing arbitrary SQL when malicious content is stored in url_key. The vulnerability carries an 9.3 CVSS score, indicating a high‑severity impact if exploited.

The affected product is EverShop evershop. Versions prior to the 2.1.1 release are vulnerable; the fix is available in v2.1.1 and later releases.

The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation probability in the wild. The likely attack vector requires an attacker to inject malicious characters into the url_key field, which typically necessitates privileged access to modify category data. If achieved, the attacker could achieve unauthorized data export or alteration.