CVE-2019-25497

CVE-2019-25497 is a SQL injection vulnerability in osCommerce version 2.3.4.1, affecting the shopping_cart.php component. The flaw arises from insufficient sanitization of the currency parameter, allowing attackers to inject malicious SQL code into database queries via GET requests. This vulnerability is classified under CWE-89 (SQL Injection) and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its potential for remote information disclosure.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting boolean-based blind SQL injection payloads in the currency parameter, they can manipulate queries to extract sensitive database information, such as user credentials or other confidential data stored in the osCommerce database. The impact primarily targets confidentiality with high effect, alongside low integrity impact, but no availability disruption.

Advisories and related resources, including an Exploit-DB entry (https://www.exploit-db.com/exploits/46328) providing a proof-of-concept, the official osCommerce website (https://www.oscommerce.com), and a VulnCheck advisory (https://www.vulncheck.com/advisories/oscommerce-sql-injection-via-currency-parameter), document the issue but do not specify patch availability in the provided details. Security practitioners should verify for updates on the vendor site and apply input validation or parameterized queries as general mitigations for SQL injection risks.