What’s Vulnerable › Vulnerabilities

CVE-2019-25260: OXID eShop 6.3.4 - 'sorting' SQL Injection

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-89

Description

OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.

Affected products

• OXID-eSales OXID eShop: from Versions 6.x (prior through 6.3.4)

References

• https://bugs.oxid-esales.com/view.php?id=7002
• https://github.com/OXID-eSales/oxideshop_ce
• https://web.archive.org/web/20190731211638/https://blog.ripstech.com/2019/oxid-esales-shop-software/
• https://web.archive.org/web/20201020223434/https://www.vulnspy.com/en-oxid-eshop-6.x-sqli-to-rce/
• https://www.exploit-db.com/exploits/48527
• https://www.oxid-esales.com/
• https://www.vulncheck.com/advisories/oxid-eshop-sorting-sql-injection

Get alerted when CVE-2019-25260 or the next vulnerability affects your stack