The web application exposes an SQL injection flaw in the listPagedSpuForApp endpoint of the SpuController, which accepts an unsanitized sortField/sort argument. By injecting SQL through these parameters, an attacker can manipulate the query executed against the backend database, potentially retrieving sensitive data or executing arbitrary SQL statements. The vulnerability is identified as CWE‑74 and CWE‑89 and allows for remote exploitation, meaning an attacker does not need local access to threaten the system. The vendor listed the issue but did not respond to the disclosure, and a public exploit was already released.

This vulnerability affects the youlaitech youlai‑mall application, specifically version 2.0.0. The associated CPE is cpe:2.3:a:youlai:youlai-mall:2.0.0:*:*:*:*:*:*:* and the affected component is the App‑side Product Pagination Endpoint in SpuController.java.

The CVSS score is 5.3, indicating moderate severity. EPSS is reported as < 1%, meaning the probability of exploitation is low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via manipulation of the sort parameters, and because a public exploit exists, attackers could target any exposed instance of the vulnerable application.