Craft Commerce is vulnerable to a SQL injection flaw in the inventory levels data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization, allowing an authenticated attacker to inject arbitrary SQL statements. This can lead to the exfiltration of or modification of the entire database, as the attacker can execute any query supported by the underlying database engine.

The flaw affects all installations of Craft Commerce running any version prior to 5.5.3. The affected component is the Commerce Inventory section of the Craft CMS platform, offered by the vendor brand name craftcms:commerce.

The vulnerability carries a high CVSS score of 8.7 and an EPSS score below 1%, indicating that while exploitation is technically possible for an attacker with the required privileges, the overall probability of real-world exploitation is low. The flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but it remains a serious threat because it permits a full database compromise once authenticated. The attack path requires the attacker to be logged in to the Craft CMS backend with sufficient permission to view the Commerce Inventory section. Once those conditions are met, the attacker can exploit the unvalidated sort parameters to inject and execute arbitrary SQL.