Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Ashop Shopping Cart Software allows attackers to extract sensitive database info

CVE-2019-25391 · published 8 months ago
Summary

Ashop Shopping Cart Software has a security flaw that lets attackers steal sensitive database information. If not fixed, this could allow hackers to access confidential data. You should update to the latest version of Ashop Shopping Cart Software to prevent this issue.

Original advisory text
Ashop Shopping Cart Software contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through the blacklistitemid parameter. Attackers can send P...
Ashop Shopping Cart Software contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through the blacklistitemid parameter. Attackers can send POST requests to the admin/bannedcustomers.php endpoint with crafted SQL payloads using SLEEP functions to extract sensitive database information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published22 Feb 2026
Updated31 Oct 2026
First seen6 Mar 2026
Sources
CVE-2019-25391 · NVD
Track software like this
Free during beta