Vulnerability Description
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oscommerce | Oscommerce | <= 2.3.4.1 |
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/46328ExploitVDB Entry
- https://www.oscommerce.comProduct
- https://www.vulncheck.com/advisories/oscommerce-sql-injection-via-currency-paramThird Party Advisory
FAQ
What is CVE-2019-25497?
CVE-2019-25497 is a vulnerability with a CVSS score of 8.2 (HIGH). osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send ...
How severe is CVE-2019-25497?
CVE-2019-25497 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25497?
Check the references section above for vendor advisories and patch information. Affected products include: Oscommerce Oscommerce.