CVE-2025-27892
MEDIUM
Published 2025-04-15T00:00:00.000Z
Actions:
CVSS Score
V3.1
6.8
/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Base Score Metrics
Exploitability: N/A
Impact: N/A
Attack Vector Metrics
Impact Metrics
Description
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.
Available Exploits
Shopware < 6.5.8.13 - SQL Injection
The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The name field in this "aggregations" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.
ID: CVE-2025-27892
Author: iamnoooobrootxharshpdresearch
Critical
Related News
No news articles found for this CVE.
References
Published: 2025-04-15T00:00:00.000Z
Last Modified: 2025-04-16T18:32:23.303Z
Copied to clipboard!