A critical SQL injection vulnerability in Craft Commerce allows authenticated attackers to potentially compromise the entire backend database.

The application is vulnerable to SQL injection due to improper sanitization of the sort[0][direction] and sort[0][sortField] parameters. This flaw resides in the inventory levels table data endpoint and requires an attacker to possess authenticated access to the Commerce Inventory section.

The ability to perform SQL injection poses a severe risk to data integrity and confidentiality, as it may allow an attacker to read, modify, or delete sensitive ecommerce data. With a CVSS score of 8.8, the vulnerability is classified as High severity because it can lead to full database compromise. Such an event would likely result in significant business disruption, loss of customer trust, and potential regulatory non-compliance regarding data protection.

Immediate Action: Update the Craft Commerce plugin to version 5.5.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax associated with the Commerce Inventory section.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter malicious SQL injection patterns directed at administrative endpoints.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for total database compromise, administrators should prioritize updating Craft Commerce to version 5.5.3 immediately. While the vulnerability requires authentication, the risk remains substantial in environments where internal user accounts may be compromised or where least privilege is not strictly enforced.