The vulnerability originates from unsanitized user input in the ProductMapper.xml and OrderUtil.java components of uzy-ssm-mall, allowing a remote attacker to inject arbitrary SQL statements. This flaw can be exploited to read, modify, or delete database contents, leading to confidentiality and integrity violations. Attackers do not need elevated privileges within the application; the input is processed directly by the database driver and executed without validation.

uzy-ssm-mall version 1.1.0 is affected; no other versions or vendors are listed in the public data. The flaw exists in the stated components and applies across all installations of this specific version.

The CVSS score is 5.3 and the EPSS score is < 1%, suggesting moderate severity but a low probability of exploitation. The flaw is listed as not KEV, indicating no known active exploitation at this time. However, SQL injection remains a high-severity risk due to the potential for arbitrary query execution. It is inferred that the attack vector is purely remote, requiring only the ability to send crafted requests to the vulnerable components. Organizers have reported the issue publicly, suggesting awareness and potential for exploitation in the future.