CVE-2019-25496: osCommerce 2.3.4.1 SQL Injection via products_id Parameter
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the productsid parameter. Attackers can modify the productsid value in productinfo.php requests and append boolean-based SQL injection payloads to extract sensitive database information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25496?
CVE-2019-25496 has a medium severity rating due to its SQL injection capability affecting osCommerce.
How do I fix CVE-2019-25496?
To fix CVE-2019-25496, update osCommerce to the latest version where this vulnerability has been addressed.
Who is affected by CVE-2019-25496?
Users of osCommerce version 2.3.4.1 are primarily affected by CVE-2019-25496.
What are the consequences of CVE-2019-25496?
Exploitation of CVE-2019-25496 can lead to unauthorized access and manipulation of the database.
How does CVE-2019-25496 work?
CVE-2019-25496 works by allowing attackers to inject SQL code through the products_id parameter in osCommerce.