A classic SQL injection vulnerability resides in the order() method of CrudOption.java in cool-admin-java version 8.0.0. The flaw permits an attacker to inject arbitrary SQL statements into queries generated by the application, enabling the reading, modification, or deletion of data stored in the underlying database. This represents a direct exploitation of CWE-89 and can lead to a complete compromise of database confidentiality and integrity.

The affected product is cool‑admin‑java 8.0.0. No vendor information other than the namespace cool-team-official is provided. Versions beyond 8.0.0 have not been identified as affected, and no additional product detail is disclosed.

The CVSS score of 9.8 signifies a critical risk, while the EPSS score of less than 1% indicates that active exploitation is currently unlikely. The vulnerability is not listed in CISA KEV, suggesting no publicly known exploit yet. The likely attack vector is remote, inferred from the fact that the order() method is exposed via the application’s network interface. An attacker who can reach the vulnerable endpoint can inject malicious SQL, potentially gaining full control over the database.