CVE-2019-25507:

SQL injection vulnerability in Ashop Shopping Cart Software allows unauthenticated attackers to manipulate database queries and extract sensitive information.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.2High

Published Date:Mar 4, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:4.2
Confidentiality Impact:HIGH
Integrity Impact:LOW
Availability Impact:NONE

Description Preview

SQL injection vulnerability in Ashop Shopping Cart Software allows unauthenticated attackers to manipulate database queries and extract sensitive information.

Overview

The vulnerability in Ashop Shopping Cart Software presents a significant security risk due to its high severity (CVSS v3.1 Base Score: 8.2) and ease of exploitation. The flaw requires no authentication or user interaction, making it particularly dangerous. Attackers can exploit this vulnerability remotely over the network, potentially compromising the confidentiality of sensitive data stored in the database. While the primary impact is on data confidentiality, there is also a low impact on data integrity. The vulnerability is classified as CWE-89, which is a common weakness enumeration for SQL injection flaws.

Remediation

To address this vulnerability, website administrators and developers using Ashop Shopping Cart Software should take the following steps:
1. Update the software to the latest version if a patch is available.
2. Implement proper input validation and sanitization for the 'shop' parameter and all user-supplied input.
3. Use parameterized queries or prepared statements instead of directly incorporating user input into SQL queries.
4. Apply the principle of least privilege to database users and limit the permissions of the web application's database account.
5. Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts.
6. Regularly audit and test the application for SQL injection vulnerabilities using automated tools and manual penetration testing.