An authenticated SQL injection vulnerability in Craft Commerce allows attackers to execute unauthorized database queries, posing a high risk to data integrity and system confidentiality.

The vulnerability stems from improper neutralization of input within the sort parameter of the purchasables table endpoint. An authenticated attacker can inject arbitrary SQL into the ORDER BY clause because the application fails to perform whitelist validation on the column name provided.

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.8, this vulnerability is considered high severity, as it provides a path for attackers to compromise the integrity of ecommerce transactions and sensitive customer information stored within the platform.

Immediate Action: Upgrade Craft Commerce to version 4.10.2 or 5.5.3 immediately to incorporate the required input validation fixes.

Proactive Monitoring: Review application and database logs for anomalous query patterns or unexpected SQL syntax errors originating from the purchasables endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL injection patterns in HTTP request parameters.

Public Exploit Available: No

The risk associated with this SQL injection vulnerability is significant due to the potential for total impact on data confidentiality and integrity. Security teams should prioritize patching the Craft Commerce plugin to the specified fixed versions to eliminate the underlying injection vector. If patching is not immediately feasible, ensure that access to the affected endpoints is restricted to authorized administrative personnel only.