CVE-2019-25495: osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviewsid parameter. Attackers can send GET requests to productreviewswrite.php with malicious reviewsid values using boolean-based SQL injection payloads to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25495?
CVE-2019-25495 is classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2019-25495?
To fix CVE-2019-25495, it is recommended to upgrade to a patched version of osCommerce that addresses this SQL injection vulnerability.
What systems are affected by CVE-2019-25495?
CVE-2019-25495 affects osCommerce version 2.3.4.1 specifically.
How can an attacker exploit CVE-2019-25495?
An attacker can exploit CVE-2019-25495 by sending specially crafted GET requests that include malicious SQL code through the reviews_id parameter.
What are the potential impacts of CVE-2019-25495?
The potential impacts of CVE-2019-25495 include unauthorized access to sensitive data, data manipulation, and compromised database integrity.