CVEvulnerability

CVE-2025-27892

6.8 MEDIUM Published 2025-04-15 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-04-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses: CWE-89

Description

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.

Affected configurations

• shopware shopware (< 6.5.8.17) • shopware shopware (>= 6.6.0.0 < 6.6.10.3) • shopware shopware 6.7.0.0

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References

https://github.com/shopware/shopware/security/advisories/GHSA-8g35-7rmw-7f59 Vendor Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/ Exploit

CVE-2025-27892

Description

Affected configurations

Related

Weakness · CWE (1)

References