CVE-2019-25260

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-25260
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25260.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-25260
Published
2026-02-03T22:16:20Z
Modified
2026-10-20T10:52:42Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.

References

Affected packages

Git / github.com/oxid-esales/oxideshop_ce

Affected ranges

Type
GIT
Repo
https://github.com/oxid-esales/oxideshop_ce
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f73111b460f5a3a95fc89fd0e2251e1af9be2102
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.x"
                },
                {
                    "fixed":  "6.3.4"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v4.*
v4.8.0
v4.8.0_beta1
v4.8.0_rc1
v4.8.0_rc2
v6.*
v6.0-beta.1
v6.0-beta.3
v6.0.0
v6.0.0-rc.1
v6.0.0-rc.2
v6.0.0-rc.3
v6.1.0
v6.2.0
v6.3.0
v6.3.1
v6.3.2
v6.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25260.json"