Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

OXID eShop lets attackers steal data via URL

CVE-2019-13026 · published 7 years ago
Summary

Versions of OXID eShop before 6.0.5 and 6.1.4 can be tricked with a specially crafted web address to run unauthorized database commands. This could give a malicious party full control over the online store, including customer information and order details. Update to the latest version of OXID eShop as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oxid-esales eshop >= 6.0.0, < 6.0.5
>= 6.1.0, < 6.1.4
cpe:2.3:a:oxid-esales:eshop:*:*:*:*:*:*:*:*
Original advisory text
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the d...
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published30 Jul 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-13026 · NVD
Track software like this
Free during beta