CVE-2019-25260

OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.

CVSS v4.0

8.8 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-02-03

Updated

2026-07-15

Proof-of-concept exploits (3)

• https://www.exploit-db.com/exploits/48527
• https://web.archive.org/web/20201020223434/https://www.vulnspy.com/en-oxid-eshop-6.x-sqli…
• https://web.archive.org/web/20190731211638/https://blog.ripstech.com/2019/oxid-esales-sho…

References

• CVE Record
• NVD entry

Related

• CVE-2019-25259
• CVE-2019-25261
• CVE-2019-25258
• CVE-2019-25263
• CVE-2019-25257
• CVE-2019-25264