Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-25497: osCommerce: Malicious Code Can Be Injected Through Currency Parameter

CVE-2019-25497 · published 8 months ago

Summary

osCommerce, a shopping cart software, has a bug that allows hackers to inject malicious code into the database. This can happen when a user enters a special value in the currency field, allowing the hacker to access sensitive information. To protect your store, update to a fixed version of osCommerce or apply the recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oscommerce	oscommerce	<= 2.3.4.1 `cpe:2.3:a:oscommerce:oscommerce::::::::`

Original advisory text

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.

References

https://www.exploit-db.com/exploits/46328 Exploit VDB Entry
https://www.oscommerce.com Product
https://www.vulncheck.com/advisories/oscommerce-sql-injection-via-currency-param... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published27 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2019-25497 · NVD

Track software like this

Free during beta