CVEvulnerability
CVE-2019-25260
8.8 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-02-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.8 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-89
Description
OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://bugs.oxid-esales.com/view.php?id=7002 bugs.oxid-esales.com
- https://github.com/OXID-eSales/oxideshop_ce github.com
- https://web.archive.org/web/20190731211638/https://blog.ripstech.com/2019/oxid-esales-shop-software/ web.archive.org
- https://web.archive.org/web/20201020223434/https://www.vulnspy.com/en-oxid-eshop-6.x-sqli-to-rce/ web.archive.org
- https://www.exploit-db.com/exploits/48527 www.exploit-db.com
- https://www.oxid-esales.com/ www.oxid-esales.com
- https://www.vulncheck.com/advisories/oxid-eshop-sorting-sql-injection www.vulncheck.com